LDAP Modify

Introduction

Use this valve to modify an LDAP entry based on values in an item.

An LDAP modify request contains one or more modifications that are applied to the target entry. The following modification types are supported

• ADD
• REPLACE
• DELETE

Each modification uses the name and the value of a property on the current item and therefor item property names must match the LDAP entry names (specified in the LDAP schema). By default the item id is used as the distinguished name (DN) of the entry to modify. If dn_parameter is set, that value is used instead.

Prerequisites

Before using this valve the LdapClient module must be configured and deployed.

Configuration

Note

Valve name: LDAPModify

Common LDAP valve configuration can be found here.

Properties

Name	Description	Default value	Mandatory	Expanded
add	List of item properties to add.	N/A
replace	List of item properties to replace.	N/A
delete	List of item properties to delete.	N/A
ignore_empty_values	Ignore empty values in add and replace modifications. If all configured attributes have empty values the LDAP request is skipped and the valve succeeds without error.	false
dn_parameter	If not using item.id() as DN value.	N/A

Example

{
  "name" : "LDAPModify",
  "config" : {
    "destination" : "default",
    "dn_parameter" : "${item.dn}",
    "add" : "mail,mobile"
  }
}

Audit

When AuditModule is active and the LdapClient is configured with "update": true, each successful modify operation emits an audit event.

Requires "update": true in the LdapClient audit configuration.

Valve config

{
  "name": "LDAPModify",
  "config": {
    "replace": ["cn"]
  }
}

Audit event

{
  "operation": "update",
  "client_type": "ldap",
  "data_source": "default",
  "entity_type": "entry",
  "entity_id": "uid=demo,dc=example,dc=com",
  "principal": { "subject": "[email protected]" },
  "changes": [
    { "name": "cn", "action": "replace", "value": "Demo User Modified" }
  ]
}

• entity_id — the DN of the modified entry, taken from item.id()
• changes — one entry per attribute in add, replace, or delete; action reflects the modification type