<bean id="environment" class="org.springframework.beans.factory.config.PropertiesFactoryBean">
    <property name="properties">
      <props>
        <prop key="asn.1.berlib.provider">org.apache.ldap.common.berlib.asn1.SnickersProvider</prop>
        <prop key="java.naming.security.authentication">simple</prop>
        <prop key="java.naming.security.principal">uid=admin,ou=system</prop>
        <prop key="java.naming.security.credentials">secret</prop>
        <prop key="java.naming.ldap.attributes.binary">photo personalSignature audio jpegPhoto javaSerializedData userPassword userCertificate cACertificate authorityRevocationList certificateRevocationList crossCertificatePair x500UniqueIdentifier krb5Key</prop>
      </props>
    </property>
  </bean>

  ...

  <bean id="penrose" class="org.safehaus.penrose.Penrose"/>

  ...

<entry dn="cn=...,ou=groups,dc=example,dc=com">
    ...

    <attribute name="uniqueMember">
        <expression foreach="ug.username" var="x">
            "uid="+x+",ou=users,dc=example,dc=com"
        </expression>
    </attribute>

    <source name="ug">

        ...

        <field name="username">

            <expression foreach="uniqueMember" var="x">
int i = x.indexOf("=");
int j = x.indexOf(",");
return x.substring(i+1, j);
            </expression>

        </field>

    </source>

</entry>