An attribute in an entry is defined as follows:

<at name="..." rdn="...">
    <expression>...</expression>
</at>

Attribute Name

The "name" contains the attribute name, e.g. cn, ou. Penrose currently does not validate the attribute names nor the values against the schema.

Attribute Value

The attribute value is defined as BeanShell script/expression. To define a constant value you need to enclose it with quotes:

<at name="o">
    <expression>"Example, Inc."</expression>
</at>

To map an attribute to a datasource, first you need to specify the source in the entry. Then you can refer to the source fields in this format: sourceName.fieldName.

<entry dc="cn=...,ou=Groups,dc=Example,dc=com">
    ...
    <at name="description">
        <expression>groups.description</expression>
    </at>
    <source name="groups">
        ...
    </source>
</source>

RDN

If the attribute is used as RDN, you need to set rdn="true". Otherwise, by default the rdn is false.

In static entries:

<entry dn="dc=Example,dc=com">
    ...
    <at name="dc" rdn="true">
        <expression>"Example"</expression>
    </at>
</entry>

In dynamic entries:

<entry dn="cn=...,ou=Groups,dc=Example,dc=com">
    ...
    <at name="cn" rdn="true">
        <expression>groups.groupname</expression>
    </at>
    ...
</entry>