LDAP Attributes Mapping

Relevant source files

The following files were used as context for generating this wiki page:

• src/flext_dbt_ldap/constants.py
• src/flext_dbt_ldap/_constants/attributes.py
• src/flext_dbt_ldap/services/client.py
• src/flext_dbt_ldap/settings.py
• src/flext_dbt_ldap/_utilities/integration.py
• tests/unit/test_constants_flat_api.py
• src/flext_dbt_ldap/protocols.py

LDAP Attributes Mapping is a core mechanism within the flext-dbt-ldap project designed to bridge the gap between hierarchical LDAP directory data and relational data warehouse structures. It enables the systematic extraction of attributes from LDAP entries and their transformation into typed dbt models, such as user dimensions, group dimensions, and membership facts.

The system relies on a combination of predefined constants, runtime settings, and transformation utilities to ensure data consistency and quality. This mapping facilitates complex data flows, including the normalization of timestamps and the resolution of group memberships into flattened relational tables.
Sources: src/flext_dbt_ldap/services/client.py, src/flext_dbt_ldap/_utilities/integration.py

Attribute Definitions and Constants

The project defines a set of canonical LDAP attribute names used throughout the extraction and transformation lifecycle. These are categorized into identity, membership, and metadata attributes.

Canonical Attribute Constants

The following table outlines the primary attribute constants defined for the project:

Constant Name	LDAP Attribute Name	Description
UID	uid	User unique identifier
CN	commonName	Canonical/Common name
MAIL	mail	Email address
MEMBER	member	Group membership (DN list)
MEMBER_OF	memberOf	Reverse membership attribute
CREATE_TIMESTAMP	createTimestamp	Entry creation time
MODIFY_TIMESTAMP	modifyTimestamp	Entry modification time

Sources: src/flext_dbt_ldap/_constants/attributes.py:16-33, src/flext_dbt_ldap/constants.py

Attribute Groups

Attributes are further grouped into functional collections to support specific validation and search operations:

• USER_ID_ATTRIBUTES: Includes uid, cn, and samaccountname for identifying user entities.
• MEMBERSHIP_ATTRIBUTES: Includes member, uniqueMember, and memberUid for resolving group memberships.
  Sources: src/flext_dbt_ldap/_constants/attributes.py:34-41

Mapping Logic and Architecture

The mapping architecture involves a multi-stage process where raw LDAP attributes are first extracted, then mapped to internal field names based on user configuration, and finally validated against quality thresholds.

Transformation Flow

The following diagram illustrates the flow from a raw LDAP entry to a mapped dbt-ready structure:

The mapping logic is implemented in the FlextDbtLdapClientMixin, specifically within the _map_entry_attributes and _prepare_ldap_data_for_dbt methods.
Sources: src/flext_dbt_ldap/services/client.py:157-208

Runtime Configuration

Mapping is driven by the FlextDbtLdapSettings class, which allows users to define custom attribute relationships and schema targets:

• ldap_attribute_mapping: A dictionary mapping LDAP-specific keys to dbt model field names.
• ldap_schema_mapping: A dictionary mapping LDAP object classes (e.g., "users") to target database tables.
  Sources: src/flext_dbt_ldap/settings.py:65-80

Membership Resolution

One of the most critical mapping functions is the resolution of group memberships. The system supports both direct membership (group-centric) and reverse membership (user-centric) resolution to create MembershipFact models.

Membership Mapping logic

1. Group-Centric: Extracts DNs from attributes like member or uniqueMember within a group entry.
2. User-Centric: Extracts group DNs from the memberOf attribute within a user entry.
   Sources: src/flext_dbt_ldap/_utilities/integration.py:65-98

Data Quality and Schema Compliance

Mapping includes a validation layer to ensure that required attributes are present and that entries match the expected LDAP object classes before they are sent to the warehouse.

Validation Metrics

The validate_ldap_data method calculates a quality score based on the presence of required_attributes defined in settings. If the quality_score falls below the min_quality_threshold (defaulting to 0.8), the mapping process for that batch fails.
Sources: src/flext_dbt_ldap/services/client.py:118-155, src/flext_dbt_ldap/settings.py:53-63

Object Class Mapping

To categorize entries into the correct dbt models, the system uses objectClass matching:

• Users: Matches person, user, or inetOrgPerson.
• Groups: Matches group, groupOfNames, or groupOfUniqueNames.
• Organizational Units: Matches organizationalUnit or organization.
  Sources: src/flext_dbt_ldap/_constants/attributes.py:42-53, src/flext_dbt_ldap/services/client.py:186-198

Implementation Example: User Dimension

A typical mapping operation converts a complex LDAP entry into a flattened UserDimension object.

# Mapped Attributes in UserDimension
# Sources: tests/unit/test_constants_flat_api.py:35-50
dimension.user_id = entry["uid"]
dimension.common_name = entry["cn"]
dimension.email = entry["mail"]
dimension.department = entry["department"]
dimension.employee_number = entry["employeeNumber"]
dimension.created_date = entry["createTimestamp"]
dimension.modified_date = entry["modifyTimestamp"]

Sources: tests/unit/test_constants_flat_api.py:35-65

Conclusion

LDAP Attributes Mapping in flext-dbt-ldap provides a robust framework for converting unstructured directory data into clean, relational models. By leveraging strict constants and configurable mapping settings, it ensures that diverse LDAP schemas can be unified into a consistent data warehouse structure suitable for enterprise analytics.