Double-click the subtree entry to open the entry editor in the main window.

Double-click the virtual attribute to map, listed in the Attributes section of the LDAP tab.

Select the radio button for how the value will be supplied. text sets an exact value, variable allows you to choose from all attributes configured for the virtual directory sources, and expression accepts BeanShell scripts.

In the subtree editor window, open the Sources tab, and, if there is more than one source, select the correct source tab at the top of the section.

Double-click the corresponding source attribute in the list.

If the attribute is not listed, click the Add field link at the bottom, and add the attribute, then select it.

Select the radio button for how the value will be supplied. text sets an exact value, variable includes the attributes configured for all virtual directory sources as well as the virtual directory itself, and expression accepts BeanShell scripts. For both variable and theexpression scripts, make sure that the attribute referenced is the virtual directory attribute.

Close the editor window and save the changes when prompted.

Open the Directory folder.

Create a static entry for ou=Locations, as in Section 8.2.1.2, “Adding a Static Directory Entry”.

Create a dynamic entry for the location subtree, as in Section 8.2.1.3, “Adding a Dynamic Directory Entry”.

Open the Sources folder, and double-click the offices's source. Edit the source's fields to create reverse mappings on the source from the offices and description attributes back to the l and description attributes in the offices table, respectively.

For more information on creating reverse mappings on sources, see Section 7.3, “Creating and Editing Sources Manually”.

Right-click the dynamic l=... subtree in the virtual directory, and create a dynamic subtree underneath it for the user entries, as in Section 8.2.1.3, “Adding a Dynamic Directory Entry”.

Open the Sources folder, and double-click the users's source. Edit the fields to create reverse mappings from the table's firstname and lastname attributes back to the cn, givenname, and surname attributes, respectively.

For more information on creating reverse mappings on sources, see Section 7.3, “Creating and Editing Sources Manually”.

In the Sources folder, double-click the officepeople's source, and edit it to create reverse mappings from the table's username and and offices attributes to the uid and l attributes, respectively.

For more information on creating reverse mappings on sources, see Section 7.3, “Creating and Editing Sources Manually”.

Create a directory entry and source for the offices table. Two attributes, the offices and description attributes, are mapped to the l and description attributes in the virtual entry. A reverse mapping is given mapping the attributes back to the virtual directory.

<entry dn="l=...,ou=Locations,dc=Example,dc=com">

    <oc>locality</oc>
    <at name="l" rdn="true">
        <variable>offices.offices</variable>
    </at>
    <at name="description">
        <variable>offices.description</variable>
    </at>

    <source name="offices">
        <source-name>offices</source-name>
        <field name="offices">
            <expression>l</expression>
        </field>
        <field name="description">
            <expression>description</expression>
        </field>
    </source>

</entry>

This defines the entry beneath the ou=Locations subtree.

Create the directory entry and source for the users entries. This information is taken from the users table. The mapping takes the username from the officepeople table for the virtual entry's uid attribute and the first and last names from the user's entry in the users table.

Also provide a reverse mapping from the users table attributes back to the officepeople table's username attribute and to the other user information in the users table.

<entry dn="uid=...,l=...,ou=Locations,dc=Example,dc=com">

    <oc>person</oc>
    <oc>inetOrgPerson</oc>
    <at name="uid" rdn="true">
        <variable>officepeople.username</variable>
    </at>
    <at name="cn">
        <expression>
if (users == void || users == null) return null;
return users.firstName+" "+users.lastName;
        </expression>
    </at>
    <at name="sn">
        <variable>users.lastName</variable>
    </at>

    <source name="users">
        <source-name>users</source-name>
        <field name="username">
            <variable>ug.username</variable>
        </field>
        <field name="firstName">
            <expression>
if (cn == void || cn == null) return null;
int i = cn.lastIndexOf(" ");
return cn.substring(0, i);
            </expression>
        </field>
        <field name="lastName">
            <expression>
if (cn == void || cn == null) return null;
int i = cn.lastIndexOf(" ");
return cn.substring(i+1);
            </expression>
        </field>
    </source>

</entry>

Lastly, define a reverse mapping for the officepeople table which links it back to the l attribute value drawn from the offices table.

<entry dn="uid=...,l=...,ou=Locations,dc=Example,dc=com">

    <source name="officepeople">
        <source-name>officepeople</source-name>
        <field name="l">
            <variable>offices.l</variable>
        </field>
        <field name="username">
            <variable>uid</variable>
        </field>
    </source>
</entry>

Restart Penrose Server. For example:

service vd-server restart

Open the subtree entry editor. In this case, the subtree is a dynamic subtree for Example Company groups, cn=...,ou=Groups,dc=example,dc=com.

For Example Company's group entry, there are four LDAP attributes which will be mapped:

First, configure the basic mapping between the virtual directory attributes and the sources. In the Attributes tab, select the attributes and assign them to the appropriate database attribute.

TIP

The format of Example Company's uniqueName values is uid=username, ou=people,dc=example,dc=com. To configure that, the uniqueName value is an expression which builds the DN from the database's username:

Open the Sources tab for the subtree entry.

Configure the reverse mapping for the primary source. In this case, the primary source is the groups database.

On the users database source, map the existing groupname database attribute to the primary key attribute on the groups source.

On the users database source, configure the basic mapping for the username database attribute to the uniqueMember attribute.

Close the editor window and save the changes when prompted.

Add the attributes to be mapped to the main entry. For Example Company's group mapping:

<entry dn="cn="...",dc=ou=Groups,dc=example,dc=com">
     <at name="cn" rdn="true">
          <variable>groups.groupname</variable>
     </at>
     <at name="description">
          <variable>groups.description</variable>
     </at>
     <at name="uniqueMember">
          <expression foreach="users.username" var="username">
                "uid="+username+",ou=Users,dc=Example,dc=com"
           </expression>
     </at>

In the source entry for the groups database, add the reverse mapping for the cn and description attributes:

<source>
     <source-name>groups</source-name>
...
     <field name="groupname">
          <variable>cn</variable>
     </field>

     <field name="description">
          <variable>description</variable>
     </field>
...
</source>

In the source entry for the users database, add the reverse mapping for the uniqueMember attributes:

<source>
     <source-name>users</source-name>
...
     <field name="username">
          <variable>uniqueMember</variable>
     </field>
...
</source>

Add the mapping from the users database to the primary key in the groups database, the groupname attributes. This is required for Penrose Virtual Directory to recognize which database entries are to be joined. Any user entry with a matching group entry will be mapped into the group members' list.

<source>
     <source-name>users</source-name>
...
     <field name="groupname">
          <variable>groups.groupname</variable>
     </field>
...
</source>

Restart the Penrose Server.

service vd-server restart