Custom Expressions and System Variables

using custom expressions in rule configuration this topic describes custom expressions it is intended for advanced users custom expressions many system rules, such as role mapping rules or resource policy rules, support custom expressions a custom expression is a combination of variables that the system evaluates as a boolean object the expression returns true, false, or error you can write custom expressions in the following formats note that elements of these formats are described in greater detail in the table that follows variable comparisonoperator variable variable comparisonoperator simplevalue variable comparisonoperator (simplevalue) variable comparisonoperator (or values) variable comparisonoperator (and values) variable comparisonoperator (time to time) variable comparisonoperator (day to day) isemtpy (variable) isunknown (variable) (customexpr) not customexpr ! customexpr customexpr or customexpr customexpr || customexpr customexpr and customexpr customexpr && customexpr the custom expression should be less than 64k custom expression elements the following table describes the custom expression elements element description variable represents a system variable a variable name is a dot separated string, and each component can contain characters from the set \[a z a z 0 9 ] but cannot start with a digit \[0 9] variable names are case insensitive for system variables that you may use in role mapping rules and resource policies when writing a custom expression in a log query field, you need to use system log variables these variables are described in the filter variables dictionary on the filter page ( system > log/monitoring > events | user access | admin access > filters > select filter tab) quoting syntax for variables the system supports a quoting syntax for custom expression variables that allows you to use any character except ' ' (period) in a user attribute name to escape characters in an attribute name, quote some or all of the variable name using { } (curly braces) for example, these expressions are equivalent userattr = 'xyz' userattr login name = 'xyz' = 'xyz' usera name = 'xyz' escape characters supported within quotes \\\\ escape a backslash (\\) \\{ escape a left curly brace ({) \\} escape a right curly brace (}) \hh escape a hexadecimal value where hh is two characters from \[0 9a fa f] examples userattr {tree frog} = 'kermit' userattr {tree\20frog} = 'kermit' there is no limit to the number of quotes you can use in a variable name you can use the quoting syntax with any variable, not just userattr variables you need to use curly brace quotes only when writing custom expressions \ comparisonoperator \ one of the following = equal to use with strings, numbers, and dns != not equal to use with strings, numbers, and dns < less than use with numbers <= less than or equal to use with numbers > greater than use with numbers >= greater than or equal to use with numbers \ simplevalue \ one of the following string quoted string that may contain wildcards ip address a b c d subnet a b c d/subnetbitcount or a b c d/netmask number positive or negative integer day sun mon tue wed thu fri sat notes about strings a string may contain all characters except \<nl> (newline) and \<cr> (carriage return) strings can be any length string comparisons are case insensitive strings can be quoted with single or double quotes a quoted string may contain wildcards, including star( ), question mark (?), and square brackets (\[ ]) variable comparisonoperator variable comparisons are evaluated without wildcard matching use a backslash to escape these characters single quote (') \\' double quote (") \\" backslash (\\) \\\ hexadecimal \hh \[0 9a fa f] note about day day and time comparisons are evaluated in the system's time zone day range (day to day) calculations start with the first day and step forward until the second day is reached in time range (time to time) calculations, the first value must be earlier than the second value only time variables can be compared to day and time values the time variables are time and logintime \ time \ time of day in one of the following formats hh\ mm 24 hour hh\ mmam 12 hour hh\ mmpm 12 hour h\ mm 24 hour h\ mmam 12 hour h\ mmpm 12 hour day and time comparisons are evaluated in the system's time zone day range (day to day) calculations start with the first day and step forward until the second day is reached in time range (time to time) calculations, the first value must be earlier than the second value only time variables can be compared to day and time values the time variables are time and logintime \ or value \ string containing one or more or comparisons examples variable comparisonoperator (number or number ) variable comparisonoperator (string or string ) \ and value \ string containing one or more and comparisons examples variable comparisonoperator (number and number ) variable comparisonoperator (string and string ) \ isempty \ function that takes a single variable name (variable) argument and returns a boolean value isempty() is true if the variable is unknown or has a zero length value, zero length strings, and empty lists example isempty(userattr terminationdate) \ isunknown \ function that takes a single variable name (variable) argument and returns a boolean value isunknown() is true if the variable is not defined user attributes (userattr variables) are unknown if the attribute is not defined in ldap or if the attribute lookup failed (such as if the ldap server is down) example isunknown(userattr bonusprogram) \ not, ! \ logical negation comparisonoperator the negated expression evaluates to true if the customexpr is false and evaluates to false if the customexpr is true the operators not, and, and or are evaluated from highest to lowest precedence in this order not (from right), and (from left), or (from left) \ or, || \ logical operator or or ||, which are equivalent the operators not, and, and or are evaluated from highest to lowest precedence in this order not (from right), and (from left), or (from left) \ and, \&\& \ logical and or &&, which are equivalent the operators not, and, and or are evaluated from highest to lowest precedence in this order not (from right), and (from left), or (from left) \ customexpr \ expression written in the custom expression syntax (see above) wildcard matching in a quoted string, supported wildcards include star ( ) a star matches any sequence of zero or more characters question mark (?) a question mark matches any single character square brackets (\[ ]) square brackets match one character from a range of possible characters specified between the brackets two characters separated by a dash ( ) match the two characters in the specified range and the lexically intervening characters for example, 'dept\[0 9]' matches strings "dept0", "dept1", and up to "dept9" to escape wildcard characters, place them inside square brackets for example, the expression ' userattr x = " value \[ ]" ' evaluates to true if attribute x is exactly "value " using multivalued attributes multivalued attributes attributes that contain two or more values provide you with a convenient method for defining resources that expand into multiple individual bookmarks on the users' bookmarks page for example, assume that the user's ldap directory contains the multivalued attribute homeshares \\\srv1\sales;\\\srv2\marketing when you configure the windows file share resource definition using the homeshares multivalued attribute, \\\\\<userattr homeshares>, the user sees two bookmarks \\\srv1\sales \\\srv2\marketing now let's assume the user's ldap directory contains a second multivalued attribute defined as homefolders folder1;folder2;folder3 when you configure the windows file share resource using both of the multivalued attributes, \\\\\<userattr homeshares>\\\<userattr homefolders>, the user sees the following six bookmarks \\\srv1\sales\folder1 \\\srv1\sales\folder2 \\\srv1\sales\folder3 \\\srv2\marketing\folder1 \\\srv2\marketing\folder2 \\\srv2\marketing\folder3 the only exception to this functionality is when the variable includes an explicit separator string in this case, only one bookmark containing multiple resources displays on the users' bookmark page you specify the separator string in the variable definition using the syntax sep='string' where string equals the separator you want to use for example, to specify a semi colon as the separator, use the syntax \<variable attr sep=';'> use the following syntax for multivalued attributes handling note that \<variable> refers to a session variable such as < userattr name> or \<certattr name > \<variable\[index]> you specify indexes in a variety of ways if, for example, the total number of values for a given index is 5, and you want to specify the entire range of values you use \<variable\[all]> if you want to specify only the fourth value, you use \<variable\[4]> \<variable> is the same as \<variable\[all]> \<variable> is the same as \<variable\[all]> \<variable sep='str'> and \<variable\[all] sep='str'> these variable definitions always refer to a single string value with all the tokens expanded out with separator strings between the values variable names cannot contain spaces specifying multivalued attributes in a bookmark name another common case of using multivalued attributes occurs when you include a variable in a bookmark name and in a url or file server/share field for example, again assume that the user's ldap directory contains the multivalued attribute homeshares \\\srv1\sales;\\\srv2\marketing when you configure the windows file share resource definition using the homeshares multivalued attribute, \\\\\<userattr homeshares>, and you use the same attribute in the bookmark name field, \<userattr homeshares>, the system creates two bookmarks srv1\sales bookmark pointing to \\\srv1\sales srv2\marketing bookmark pointing to \\\srv2\marketing this does not create a situation in which you end up with the following set of conditions srv1\sales bookmark pointing to \\\srv1\sales srv1\marketing bookmark pointing to \\\srv1\marketing (error) srv2\sales bookmark pointing to \\\srv1\sales (error) srv2\marketing bookmark pointing to \\\srv2\marketing distinguished name variables you can compare a distinguished name (dn) to another dn or to a string, but the system ignores wildcards, white space, and case note, however, that the system takes the order of dn keys into consideration when the system compares an expression to a dn to a string, it converts the string to a distinguished name before evaluating the expression if the system cannot convert the string due to bad syntax, the comparison fails the dn variables are userdn certdn certissuerdn the system also supports dn suffix comparisons using the matchdnsuffix function for example matchdnsuffix( certdn, "dc=danastreet,dc=net") within the parenthesis, the first parameter is the " full" dn and the second is the suffix dn you can use a variable or string for each parameter note that this first parameter should have more keys than the second (suffix parameter) otherwise, if they are equal, it is the same as \<firstparam> = \<secondparam> if the second parameter has more keys, matchdnsuffix returns false system variables the following table lists and defines system variables, gives an example for each system variable, and provides a guide as to where you may use system variables the following table lists the system variables and examples variable description examples authmethod type of authentication method used to authenticates a user role mapping rules, resource policy rules authmethod = 'ace server' certattr \<cert attr> attributes from a client side certificate examples of certattr attributes include c country cn common name description description e mailaddress e mail address gn given name initials initials l locality name o organization ou organizational unit sn surname serialnumber serial number st state or province title title ui unique identifier use this variable to check that the user's client has a client side certificate with the value(s) specified role mapping rules resource policy rules sso parameter fields ldap configuration certattr ou = 'retail products group' certattr altname \<alt attr> subject alternative name value from a client side certificate where \<alt attr> may be email emailld emaildomain dns registeredid ipaddress upn upnid upndomain fascn fascnac fascnsc fascncn fascncs fascnici fascnpi fascnoc fascnoi fascnpoa fascnlrc role mapping rules resource policy rules sso parameter fields ldap configuration certattr altname email = "joe\@company com" certattr altname ipaddress = 10 10 83 2 certattr serialnumber client certificate serial number note that all characters other than \[0 9 a f a f] are stripped out of a string before comparison with certattr sn wildcards are not supported role mapping rules resource policy rules sso parameter fields ldap configuration certattr serialnumber = userattr certserial certattr serialnumber = "6f 05 45\ ab" certdn client certificate subject dn wildcards are not permitted role mapping rules, resource policy rules certdn = 'cn=john harding,ou=eng,c=company' certdn = userdn (match the certificate subject dn with the ldap user dn) certdn = userattr x509subjectname certdn = ('cn=john harding,ou=eng,c=company' or 'cn=julia yount,ou=eng,c=company') certdn \<subject attr> any variable from the client certificate subject dn, where subject attr is the name of the rdn key use to test the various subject dn attributes in a standard x 509 certificate role mapping rules resource policy rules sso parameter fields ldap configuration certdn ou = 'company' certdn e = 'joe\@company com' certdn st = 'ca' certdntext client certificate user dn stored as a string only string comparisons to this value are allowed role mapping rules resource policy rules sso parameter fields certdntext = 'cn=john harding,ou=eng,c=company' certattr ekutext the enhanced key usage field, abbreviated as eku has 2 components to it one part of it is the text which is in human readable format and the second part is the oid number which is unique for a given purpose the user has the flexibility to create rules and realm based restrictions using either of the two format to be given is ekutext = string or \<comma separated string> or string with regular expression custom expressions need to be given with the following format certattr ekutext = string or \<comma separated string> or string with regular expression role mapping rules resource policy rules sso parameter fields certattr ekutext = "tls web server authentication","e mail protection","tls web client authentication" certattr ekuoid format to be given is ekuoid = to a b c d e f g h i or \<comma separated list of ekuoids> or oid with regular expressions this works in both certificate rule as well as custom expressions custom expressions need to be given with the following format certattr ekuoid = a b c d e f g h i or \<comma separated list of ekuoids> or oid with regular expressions certattr ekuoid=1 3 6 1 5 5 7 3 1,1 3 6 1 5 5 7 3 4,1 3 6 1 5 5 7 3 2 certissuerdn client certificate issuer subject dn this variable works like a standard dn attribute such as certdn wildcards are not permitted role mapping rules resource policy rules sso parameter fields certissuerdn = 'cn=john harding,ou=eng,c=company' certissuerdn = userattr x509issuer certissuerdn = ('ou=eng,c=company' or 'ou=operations,c=company') certissuerdn \<issuer attr> any variable from the client certificate issuer subject dn, where issuer attr is the name of the rdn key role mapping rules resource policy rules sso parameter fields certissuerdn ou = 'company' certissuerdn st = 'ca' certissuerdntext client certificate issuer subject dn stored as a string only string comparisons to this value are allowed role mapping rules resource policy rules sso parameter fields certissuerdntext = 'cn=john harding,ou=eng,c=company' defaultntdomain contains the domain value set in the authentication server configuration when you use ad/nt authentication role mapping rules resource policy rules sso parameter fields defaultntdomain=" corp" geolocationcountry the location from where user should be allowed or denied to login from in case you have a fresh installation of ics, then it will not have ueba package by default with it please add the ueba package at behavioral analysis page before using adaptive authentication in case of upgrade of ics from r7 or earlier to r8 or later, then ueba package is carried forwarded as is and you can still update it to latest version by uploading new package you may download latest ueba package from support site role mapping rules geolocationcountry = 'united states' geolocationcountry = ('united states' or 'canada') group \<group name> user's group membership as provided by the realm authentication or directory server role mapping rules resource policy rules only those groups evaluated for role mapping rules are available in the detailed rules (conditions) in the resource policies we recommend that you use the groups variable instead of group \<group name>, which is supported only for backwards compatibility group preferredpartner group goldpartner or group silverpartner group employees and time month = 9 combination examples allow all partners with active status from monday to friday but preferred partners monday through saturday ((group partners and time = (mon to fri)) or (group preferredpartners and time = (mon to sat))) and userattr partnerstatus = 'active' spaces are not supported, such as, group sales managers groups list of groups as provided by the realm authentication or directory server note you can enter any characters in the groupname, although wildcard characters are not supported role mapping rules resource policy rules sso parameter fields groups=('sales managers') hostcheckerpolicy host checker polices that the client has met role mapping rules resource policy rules sso parameter fields hostcheckerpolicy = ('norton' and 'sygate') and cachecleanerstatus = 1hostcheckerpolicy = ('norton' and 'sygate') loginhost hostname or ip address that the browser uses to contact theivanti secure access client service role mapping rules resource policy rules sso parameter fields ldap configuration loginhost = 10 10 10 10 logintime the time of day at which the user submits his credentials the time is based on system time note when using this variable in an sso parameter field, the variable returns the unix string time role mapping rules resource policy rules sso parameter fields logintime = (8 00am) logintime= (mon to fri) logintime day the day of month on which the user submits his credentials, where day is 1 31 the time is based on the system time you cannot use the to operator with variable role mapping rules resource policy rules logintime day = 3 logintime dayofweek the day of the week on which the user submits his credentials, where dayofweek is in the range \[0 6] where 0 = sunday the system does not support the to operator with time dayofweek expressions if you use numbers instead of strings in other words, " logintime dayofweek = (2 to 6)" does not work, but " logintime dayofweek = (mon to fri)" does work role mapping rules resource policy rules logintime dayofweek = (0 or 6) logintime dayofweek = (mon to fri) logintime dayofweek = (1) logintime dayofweek = 5 logintime dayofyear the numeric day of the year on which the user submits his credentials, where dayofyear can be set to \[0 365] you cannot use the to operator with this variable role mapping rules resource policy rules logintime dayofyear = 100 logintime month the month in which the user submits his credentials, where month can be set to \[1 12] where 1 = january you cannot use the to operator with this variable role mapping rules resource policy rules logintime month >= 4 and logintime month <=9 logintime year the year in which the user submits his credentials, where year can be set to \[1900 2999] you cannot use the to operator with this variable role mapping rules resource policy rules logintime year = 2005 loginurl url of the page that the user accessed to sign in the system gets this value from the administrator urls|user urls column on the authentication > signing in > sign in policies page of the admin console role mapping rules resource policy rules sso parameter fields ldap configuration loginurl = /admin networkif the network interface on which the user request is received possible values internal, external role mapping rules resource policy rules sso parameter fields sourceip = 192 168 1 0/24 and networkif = internal ntdomain the netbios nt domain used in nt4 and active directory authentication role mapping rules sso parameter fields ntdomain = jnpr ntuser the nt username used in active directory authentication role mapping rules sso parameter fields ntuser = jdoe password password\[1] password\[2] the password entered by the user for the primary authentication server (password and password\[1]) or the secondary authentication server (password\[2]) role mapping rules resource policy rules sso parameter fields password = a1defo2z realm the name of the authentication realm to which the user is signed in role mapping rules resource policy rules sso parameter fields realm = ('goldpartners' or 'silverpartners') and condition will always fail as a user is only allowed to sign in to a single realm in a session role list of all the user roles for the session in sso, if you want to send all the roles to back end applications, use \<role sep = ";"> where sep is the separator string for multiple values the system supports all separators except " and > resource policy rules sso parameter fields role = ('sales' or 'engineering') role = ('sales' and 'support') sourceip the ip address of the machine on which the user authenticates you can specify the netmask using the bit number or in the netmask format '255 255 0 0' note that you can evaluate the sourceip expression against a string variable such as an ldap attribute role mapping rules resource policy rules sso parameter fields sourceip = 192 168 10 20 sourceip = 192 168 1 0/24 and networkif internal userattr dept = ('eng' or 'it') and sourceip = 10 11 0 0/16 sourceip = 192 168 10 0/24 (class c) is the same as sourceip = 192 168 10 0/255 255 255 0 sourceip=userattr sourceip time the time of day at which the role mapping rule or resource policy rule is evaluated the time of the day can be in 12 hour or 24 hour format role mapping rules resource policy rules time = (9 00am to 5 00pm) time = (09 00 to 17 00) time = (mon to fri) combination examples allow executive managers and their assistants access from monday to friday userattr employeetype = (' manager ' or ' assistant ') and group executivestaff and time = (mon to fri) time day the day of month on which the user submits his credentials to, where day is 1 31 the time is based on the system time role mapping rules resource policy rules logintime day = 3 time dayofweek the day of the week on which the role mapping rule or resource policy rule is evaluated, where dayofweek is in the range \[0 6] where 0 = sunday role mapping rules resource policy rules logintime dayofweek = (0 or 6) logintime dayofweek = (1 to 5) logintime dayofweek = 5 time dayofyear the day of the year on which the role mapping rule or resource policy rule is evaluated possible values include 1 365 role mapping rules resource policy rules time dayofyear = 100 time month the month in which the role mapping rule or resource policy rule is evaluated possible values include 1 12 role mapping rules resource policy rules time month >= 9 and time month <= 12 and time year = 2004 group employees and time month = 9 time year the year in which the role mapping rule or resource policy rule is evaluated, where year can be set to \[1900 2999] role mapping rules resource policy rules time year = 2005 user user\@primary auth server name user\@secondary auth server name ivanti secure access client username for the user's primary authentication server (user and user\@primary auth server name) or secondary authentication server (user\@secondary auth server name) use when authenticating against an active directory server, domain and username primary auth server name is the name of the primary auth server if there are spaces or special characters in the name, it can be enclosed in curly brackets for example, user@{my primary auth server} secondary auth server name is the name of the secondary auth server if there are spaces or special characters in the name, it can be enclosed in curly brackets for example, user@{my secondary auth server} note when including a domain as part of a username, you must include two slashes between the domain and user for example, user='yourcompany net\\\joeuser' role mapping rules resource policy rules sso parameter fields user = 'steve' user = 'domain\\\steve' username username\@primary auth server name username\@secondary auth server name ivanti secure access client system username for the user's primary authentication server (username and username\@primary auth server name) or secondary authentication server (username\@secondary auth server name) if the user is signing in to a certificate authentication server, then the user's ivanti secure access client system username is the same as certdn cn primary auth server name is the name of the primary auth server if there are spaces or special characters in the name, it can be enclosed in curly brackets for example user@{my primary auth server} secondary auth server name is the name of the secondary auth server if there are spaces or special characters in the name, it can be enclosed in curly brackets for example user@{my secondary auth server} role mapping rules resource policy rules sso parameter fields username = 'steve' and time = mon username = 'steve' username = 'steve ' username = ('steve' or ' jankowski') useragent the browser's user agent string role mapping rules resource policy rules sso parameter fields the browser's user agent string userattr \<auth attr> user attributes retrieved from an ldap or radius, authentication or directory server role mapping rules resource policy rules sso parameter fields userattr building = ('hq ' or 'mtview\[1 3]') userattr dept = ('sales' and 'eng') userattr dept = ('eng' or 'it' or 'custsupport') userattr division = 'sales' userattr employeetype != 'contractor' userattr salarygrade > 10 userattr salesconfirmed >= userattr salesquota negative examples userattr company != "acme inc" or not group contractors not (user = 'guest' or group demo) combination examples allow executive managers and their assistants access from monday to friday userattr employeetype = (' manager ' or ' assistant ') and group executivestaff and time = (mon to fri) allow all partners with active status from monday to friday but preferred partners monday through saturday ((group partners and time = (mon to fri)) or (group preferredpartners and time = (mon to sat))) and userattr partnerstatus = 'active' userdn the user dn from an ldap server (not applicable to active directory auth server with ldap group lookup) if the user is authenticated by the ldap server, then this dn is from the authentication server; otherwise, the dn comes from the realm's directory/attribute server role mapping rules resource policy rules userdn = 'cn=john harding,ou=eng,c=company' userdn = certdn userdn \<user attr> any variable from the user dn, where user attr is the name of the rdn key role mapping rules resource policy rules sso parameter fields any variable from the user dn, where user attr is the name of the rdn key userdntext user dn stored as a string only string comparisons to this value are allowed role mapping rules resource policy rules sso parameter fields userdntext = 'cn=john harding,ou=eng,c=company' custom variables and macros custom variables, like system variables, are name value pair tags that you can use when defining role mapping rules, resource policy rules and sso parameter fields custom variables are created in the server catalog (for example, authentication > auth server > name > settings ) by using a predefined macro on a system variable available macros are regmatch matches a regular expression pattern against a string text append appends a text string to another text string daysdiff calculates the difference between two dates these macros are located under variable operators in the variables tab of the server catalog window a custom variable name is a dot separated string each component can contain characters from the set \[a z a z 0 9 ] but cannot start with a digit \[0 9] custom variable names are case insensitive custom variables are referenced as customvar \<variablename> for example, if you create a custom variable with the name check prefix, you reference this custom variable as customvar check prefix append field description syntax append (attr, textstring) append (attr, attr2) descriptions append a text string to an attribute or append an attribute to another attribute and store the resulting string in the custom variable options attr system variable of type string textstring quoted ascii string attr2 system variable of type string output fields returns a string value if no match is found, returns an empty string if the system variable is multivalued, the custom variable is also multivalued and uses the same order as the system variable sample output append (username, "@secure net") in this example, the string "@secure net" is appended to the username value daysdiff field description syntax daysdiff (attr, timeformat) description calculates the number of days between the attribute and the current time options attr system variable of type string timeformat output time format valid values are utc, timet, mmddyyyy output fields returns an integer value sample output daysdiff ( certattr validupto, utc) in this example, calculate the difference in days between the current time and the value of certattr validupto and express the time in utc (coordinated universal time) regmatch field description \syntax\ regmatch (attr, regex, groupingnumber) \description\ match the regular expression pattern against an attribute and store the result in the custom variable \options\ attr system variable of type string regex quoted string containing the regular expression to be applied to the attr option groupingnumber the group value to assign to the custom variable \additional information\ the regular expression supports the perl compatible regular expressions (pcre) syntax a grouping (capture buffer) in the regex pattern can also be used to define a custom variable \output fields\ returns a string value if no match is found, returns an empty string if the system variable is multivalued, the custom variable is also multivalued and uses the same order as the system variable \sample output\ regmatch (mailid, "^( )@ivantisecure net$", 1) in this example, a mailid of myname\@ivantisecure net creates a custom variable with value "myname" specifying fetch attributes in a realm to facilitate the support for various parameterized settings in user roles and resource policies, you have the ability to specify additional fetch attributes the system stores the fetch attributes when users log in so that you can use them in parameterized role or resource policy definitions the system pulls all the attributes that are currently stored in the sever catalog for the user's authentication or authorization ldap server so, make sure to add the ldap user attributes that are used in role or resource policy definitions in the ldap server catalog first when a user logs in, the system retrieves user attributes that are referenced in the role mapping rules plus all of the additional attributes referenced in the server catalog and stores all these values note that this should not incur a significant performance overhead because all the user attributes are retrieved in one single ldap query when you substitute variables, such as in ip/netmasks or hostnames, the values in the session are appropriately converted into the data type that is required by the particular application definition specifying the homedirectory attribute for ldap you can create a bookmark that automatically maps to a user's ldap home directory you can accomplish this using the ldap attribute homedirectory you need to configure a realm that specifies the ldap server instance as its auth server, and you need to configure role mapping rules and a bookmark that points to the ldap homedirectory attribute