anvil.server.ldap.LDAPRealm

LDAPRealm uses default groupofuniquenames objects for groups and inetorgperson for users.

Inetorgperson attribute mappings:

Field	Param name	Attribute
	(same as uid)	cn
(See *)	ctz.displayName	displayName
(used to store user permissions)		description
(used to store other variables)		physicalDeliveryOfficeName
First Name	ctz.firstName	givenname
Surname	ctz.surName	sn
Phone(w)	ctz.workPhone	telephoneNumber
Phone(h)	ctz.homePhone	homePhone
Mobile phone	ctz.mobilePhone	mobile
Postal addr(h)	ctz.homeAddress	st
Postal city(h)	ctz.homeCity	homePostalAddr
Postal code(h)	ctz.homePostalCode	roomNumber
Postal addr(w)	ctz.workAddress	street
Postal city(w)	ctz.workCity	postalAddress
Postal code(w)	ctz.workPostalCode	postalCode
PO box(w)	ctz.workPOBox	postOfficeBox
Username	ctz.username	uid
Fax number	ctz.fax	facsimileTelephoneNumber
Email	ctz.email	mail
Homepage	ctz.homepage	labeleduri
IP	ctz.ip	telexNumber
Company	ctz.company
Title	ctz.title

* Display name is a "synthetic" field that generated from first+lastname (or just username). Field is read-only.

Note. Realm support Citizen.searchCitizenByVariable() only for those fields that have an attribute mapped to them. Other fields are stored in anvil serialized form (inside one attribute) and cannot be searched.

Permissions
User permissions are stored in multiattribute (description) using following format:
[permission name]|[name]|[actions]

For example: 'tool|creator.document.**|read,write'

Following permissions can be used: tool, runtime, file, socket, java, pool, import, realm, namespace and all