\section{Configuring mapping settings}
\label{ad-connector:mapping-einstellungen}

The definition of the objects and attributes to be synchronised can be
found in the \ucsURL{/etc/univention/connector/ad/mapping.py}
file. The file is written directly in the script language Python,
which means that very flexible definitions are possible. This file is
managed via \ucsUCR{}, so that changes should always be made on the
respective template (\ucsURL{/etc/univention/connector/ad/mapping}).
It evaluates \ucsUCR{} variables for some standard options,
so that an edit of the file is not always necessary. The existing
\ucsUCR{} variables are described in Chapter
\ref{ad-connector:baseconfig-variablen:mapping}. 

The \ucsCommand{global\_ignore\_subtree} variable is used to specify a
list of areas to be ignored. In doing so, the \ucsUCR{} variables are
used according to the template mechanism, for example:

\begin{ucsConsoleInput}
global_ignore_subtree=[ 'cn=univention,@\%@ldap/base@\%@', 
                    'cn=System,@\%@connector/ad/ldap/base@\%@' ]
\end{ucsConsoleInput}

These details ensure that the \ucsCommand{cn=univention} container on
the UCS side and \ucsCommand{cn=System} container on the Active
Directory side are ignored with all subordinate objects.

All further mapping options are defined in the \emph{ad\_mapping}
directory. A clear name is always given as a key, e.g.,
\emph{user}. An \emph{univention.connector.property} object is
transferred to this key as a value. This object has the following
characteristics:

\paragraph{ucs\_module}
The \ucsUDM{} module used to edit the object. A list of all possible
modules can be output using the
\ucsCommand{univention-directory-manager modules} command.

\paragraph{sync\_mode}
The synchronisation mode to be used. Possible values are \emph{read,
write, sync} and \emph{none}. With \emph{read} the objects are
  replicated from Active Directory to UCS. With \emph{write} objects
  are replicated from Active Directory to UCS, with \emph{sync} the
  data are synchronised bidirectionally and with \emph{none} no
  changes are performed.
The global sync mode from the \ucsUCRV{connector/ad/mapping/syncmode}
is used in the predefined mapping.

\paragraph{scope}
This specifies the search depth for the LDAP searches. Possible
values are \emph{sub}, \emph{one}, \emph{base}.

\paragraph{con\_search\_filter}
The LDAP search filter used to identify the objects in Active
Directory.

\paragraph{match\_filter}
The LDAP search filter used to identify the objects in UCS. 

\paragraph{ignore\_filter}
A filter can be entered here for objects which should be ignored.

\paragraph{ignore\_subtree}
This container list is ignored along with the subordinate objects.

\paragraph{con\_create\_objectclass}
A list of object classes used on the Active Directory side.

\paragraph{dn\_mapping\_function}
A list of functions called  when converting the DN from Active
Directory to UCS and vice versa. This setting is required, e.g., with
users, as the \emph{uid} attribute is used on the UCS side and the
\emph{cn} attribute is used on the Active Directory side.

\paragraph{attributes}
A dictionary of \emph{univention.connector.attribute} objects which
can be processed directly when creating or making changes.

\paragraph{ucs\_create\_functions}
A list of functions which are run in UCS after an object has been
created.

\paragraph{post\_con\_modify\_function}
A list of functions run in Active Directory after an object is
modified.

\paragraph{post\_ucs\_modify\_functions}
A list of functions run in the UCS directory service after an object
is modified.

\paragraph{post\_attributes}
A dictionary of attributes which cannot be changed when an object is
created, but rather only in the second step.

\paragraph{mapping\_table}
A dictionary with keys corresponding to the attributes. A list of
string tuples is assigned to the key, which contain UCS and AD
denominators respectively. If a UCS object from this list is found
during synchronisation, the corresponding AD attribute is entered and
vice versa. Used, for example, when mapping group names. 

\paragraph{position\_mapping}
Assigns a container in AD to a container in UCS. Should be used
cautiously in case identically named containers exist on the other
side. For example, groups of the UCS containers \emph{cn=groups}
should not be mapped to the standard AD container \emph{cn=users} as
this container already exists in UCS. Groups saved in UCS in
\emph{cn=users} are then not placed within this reference and can
cause errors.
