{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41624,"path":"platform-security/ldap-integration/r_CommonLDAPScripts.md","title":"LDAP scripting","bundle":null,"doc_type":null,"release":"australia","body":"\n# LDAP scripting\n\nCreate custom transform maps, scripts, and business rules to specify requirements when importing data.\n\nCustom transform maps should include `onStart` and `onAfter` transform scripts.\n\nThe `onStart` script should call the `LDAPUtils` script include and start logging. For example, the **LDAP User Import** transform map has an `onStart` script that uses this code:\n\n```\ngs.include ( \"LDAPUtils\" ) ; var ldapUtils  = new LDAPUtils ( ) ;\nldapUtils. setLog (log ) ;\n```\n\nThe `onAfter` script should call the `addMembers` function. For example:\n\n```\nldapUtils.addMembers (source , target ) ;\n```\n\n## Set disabled Active Directory users to inactive\n\nUse the following script to automatically deactivate users when the associated AD user is disabled.\n\n### Before you begin\n\nRole required: admin\n\n### About this task\n\nYou can identify disabled Active Directory users by checking the value of the `userAccountControl` attribute. This rule executes whenever the `userAccountControl` value changes and deactivates user accounts if the **User Account Control** signifies a disabled AD account.\n\nUse the following script to automatically deactivate users when the associated AD user is disabled.\n\n### Procedure\n\n1.  Configure the User form and create a new integer field called **User Account Control**.\n\n2.  Add mapping for userAccountControl \\(external\\) to the new field.\n\n3.  Create a new business rule with the following properties:\n\n    |Business rule field|Value|\n    |-------------------|-----|\n    |Name|Disable AD Users|\n    |Table|User \\[sys\\_user\\]|\n    |When|Before|\n    |Condition|current.u\\_user\\_account\\_control.changes\\(\\)|\n\n    The Script field should contain the following:\n\n    ```\n    var disabledFlag = 2;\n    //perform a bitwise comparison on userAccountControl to see if the 2 bit flag is enabled\n    if (current.u_user_account_control & disabledFlag) {\n      gs.log('Disabling user: ' + current.user_name + 'userAccountControl=' + current.u_user_account_control);\n      current.active='false';\n      current.locked_out='true';\n    }\n    ```\n\n\n## Assign LDAP field values\n\nYou can use a script to assign a value to any field for which there is a field mapping.\n\nFor example, to assign a value to the sys\\_user.company field, create a field map for the company field and add a transform script of:\n\n```\ncompany = \"Don's Sporting Goods\";\n```\n\n## Exclude particular LDAP users\n\nIf you cannot completely filter the LDAP user list using LDAP filter properties, you can exclude users with a map script.\n\nAfter you have run the logic to identify a user that should not be imported, set the user\\_name field to an empty string and this user will not be imported.\n\n```\nuser_name='';\n```\n\nOne way to identify users to filter out is to look for a string in the `distinguishedName` attribute. For example, this script excludes accounts that are not in a Users OU. You might use this script if you have too many Users OU to include in the target OU LDAP Option.\n\n```\n//vdn is a variable mapped to distinguishedName\ngs.include(\"LDAPUtils\");\nvar vdn = source.getElement(this.distinguishedName);\nif (vdn.indexOf('OU=Users')<0) {\n  user_name='';\n  gs.log('LDAP Import Skipping User: ' + vdn);\n}\n```\n\nA more complex method of filtering is to use regular expressions.\n\n```\n//vcn is a variable mapped to cn\n//vdn is a variable mapped to distinguishedName\n//c is the regular expression string\ngs.include(\"LDAPUtils\");\nvar vdn = source.getElement(this.distinguishedName);\nvar vcn = source.getElement(this.cn);\nvar c = /^[a-z][a-z][a-z][0-9][0-9][0-9]$/;\nvar nvcn = vcn.toLowerCase();\n//test to see if the cn is in the form of 3 letters followed by 3 numbers, only import these\nif (c.test(nvcn)) {\n\tuser_name = nvcn;\n} else {\n\tgs.log(\"LDAP import rejected username: \" + vcn + \" for DN: \" + vdn);\n\tuser_name = \"\";\n}\n```\n\n"}}