User attributes from LDAP reach BPM in two ways: the attributes the engine synchronises into its user table (name, full name, e-mail, plus any attribute you map), and direct LDAP queries from a script when you need something the engine does not sync.
// 1. attributes known to BPM (synchronised from LDAP or set in Process Admin): JavaScript API
var u = tw.system.org.findUserByName(tw.local.userName); // TWUser
tw.local.fullName = u.fullName;
tw.local.email = u.attributes.get("Email Address"); // user attribute names as shown in Process Admin > User Management > user attributes
tw.local.manager = u.attributes.get("Manager"); // custom attribute definition mapped to an LDAP attribute (BAW: "Attribute definitions" with LDAP mapping)
// 2. anything else: query LDAP directly (JNDI) from a script - read-only, credentials from environment variables
var env = new java.util.Hashtable();
env.put("java.naming.factory.initial", "com.sun.jndi.ldap.LdapCtxFactory");
env.put("java.naming.provider.url", tw.env.ldapUrl); // ldaps://ldap.example.com:636
env.put("java.naming.security.principal", tw.env.ldapBindDn); env.put("java.naming.security.credentials", tw.env.ldapBindPw);
var ctx = new javax.naming.directory.InitialDirContext(env);
var sc = new javax.naming.directory.SearchControls(); sc.setSearchScope(javax.naming.directory.SearchControls.SUBTREE_SCOPE);
sc.setReturningAttributes(["mail", "department", "manager", "telephoneNumber"]);
var results = ctx.search(tw.env.ldapBaseDn, "(sAMAccountName=" + tw.local.userName + ")", sc);
if (results.hasMore()) {
var attrs = results.next().getAttributes();
var get = function (n) { var a = attrs.get(n); return a == null ? "" : String(a.get()); };
tw.local.department = get("department"); tw.local.phone = get("telephoneNumber"); tw.local.managerDn = get("manager");
}
ctx.close();Prefer option 1 where possible: BAW's user attribute definitions (Process Admin > User Management > Attribute definitions, or the JS API tw.system.org.findUserAttributeDefinitionByName) can be mapped to LDAP attributes so that the nightly sync fills them; then coaches and team filters read them without LDAP round trips. Option 2 needs the LDAP signer in the truststore (LDAPS), a read-only bind account, and caching (attributes rarely change - cache per instance). On CP4BA the same script works from the pod if the LDAP host is reachable; the platform's LDAP configuration does not expose arbitrary attributes to BAW.
References