> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/admin-portal/directory-integrations/user-attribute-transformation.md).

# User Attribute Transformation

***

## Overview

The **User Attribute Transformation** tab gives administrators a powerful way to customize user attributes before they are sent out in an assertion. Use it to concatenate attributes, parse multiple phone numbers from a single Active Directory (AD) attribute, filter out sensitive AD groups, and perform the transformations your applications require at login.

{% hint style="info" %}
Transformation scripts support **ECMAScript 5.1 only**. ECMAScript 6 is not supported. 
{% endhint %}

### Prerequisites

Before you begin, make sure that:

* Your system is running **AD Broker 1.08.01 or later**.
* You have permission to access the **User Attribute Transformation** tab.

### Accessing the User Attribute Transformation tab

{% stepper %}
{% step %}
**Log in**

Log in to your 1Kosmos admin console. {% endstep %}
{% endstep %}

{% step %}
**Open the Directory section**

Navigate to the **Directory** section.
{% endstep %}

{% step %}
**Select a directory**

Click the directory you want to manage. 
{% endstep %}

{% step %}
**Open the tab**

Locate the **User Attribute Transformation** tab, adjacent to the **Advanced Configuration** tab. 
{% endstep %}
{% endstepper %}

### Using the User Attribute Transformation tab

Once you've opened the tab, you can:

* **Compose scripts** — Write transformation scripts in the built-in JavaScript editor to reshape user attributes to your requirements.
* **Save a script** — Enter a one-time password (OTP) for additional verification before the script is saved.
* **Test a script** — Click **Test User Attributes**, enter a username, and review every attribute associated with that user when the username is valid.

### Sample use cases and scripts

#### Concatenate user attributes

Combine multiple user attributes into a single attribute.

```javascript
function transformUsers(usersStr) {
    const staticValue = "Himank"; // static value to concatenate.
    try {
        const users = JSON.parse(usersStr);
        for (const e of users) {
            e.fname_lname = concatenateWithDistinctAttributes(e.givenname, e.lastName); //`e.lastname` is the reference to attribute configured in AD in AdminX.
            e.static_value = concatenateWithStaticAttributes(staticValue, e.givenname); //`e.givenname` is the reference to attribute configured in AD in AdminX.
        }
        return JSON.stringify(users);
    } catch (error) {
       return {error}
    }
}

function concatenateWithDistinctAttributes(attribute1, attribute2) { //concatenates two dynamic values configured in the AD(Active directory)
    return `${attribute1}+${attribute2}`;
}

function concatenateWithStaticAttributes(staticValue, attribute) { //concatenates a dynamic and static values.
    return `${staticValue}+${attribute}`;
}
```

|                           | Given Name | Last Name |
| ------------------------- | ---------- | --------- |
| **Before transformation** | John       | Doe       |

|                          | Concatenated Name | Static Value Concatenated |
| ------------------------ | ----------------- | ------------------------- |
| **After transformation** | JohnDoe           | HimankJohn                |

#### Split mobiles and landlines from a single AD attribute

Split a single AD attribute that contains phone numbers into separate values for landlines and mobiles.

```javascript
function transformUsers(usersStr) {
    try {
        const users = JSON.parse(usersStr)
        for (const e of users) {
            if (e.facsimiletelephonenumber) {
                const phones = parsePhoneString(e.facsimiletelephonenumber);
                e.mobiles = phones.mobiles;
                e.landlines = phones.landlines;
            }
        }
        return JSON.stringify(users);
    } catch (e) {
        console.log(e.toString());
        console.log(e.stack);
    }
    return usersStr;
}

function parsePhoneString(phoneString) {
    const phones = phoneString.split(';');

    const result = {
        mobiles: [],
        landlines: []
    };

    phones.forEach(function (phone) {
        const match = phone.match(/([ML])(\d+)(x\d+)?/);
        if (match) {
            const [, type, number, extension] = match;
            const phoneNumber = extension ? `${number}${extension}` : number;
            if (type === 'M') {
                result.mobiles.push(phoneNumber);
            } else if (type === 'L') {
                result.landlines.push(phoneNumber);
            }
        }
    });

    return result;
}
```

* **Before transformation:** `M:192837496478; M: 17839978923; L:2345672349 x728`
* **After transformation:** `Mobiles: {192837496478, 17839978923} Landlines: {2345672349 x728}`

#### UAC parsing for account locked and disabled

The following script checks a user's UAC (User Account Control) values and returns whether the account is disabled or locked.

```javascript
function transformUsers(usersStr) {
    try {
        const users = JSON.parse(usersStr)

        for (const e of users) {
            const userAccountControlValue = e.useraccountcontrol || e.userAccountControl;

            e.isUserDisabled = (userAccountControlValue & 0x0002) !== 0; // Checks the user attribute values in the AD and matches with the defined condition. Please note that ['512', '544', '66048', '262656', '1049088', '520']are hardcoded as UAC values for an active user.
            e.isUserLocked = (e.lockouttime && e.lockouttime > 0) ? true : false;// A non-zero value of AD attribute `lockoutTime` denotes that the user is locked.
        }
        return JSON.stringify(users);
    } catch (e) {
        console.log(e.toString());
        console.log(e.stack);
    }
    return usersStr;
}
```

### Summary

With the **User Attribute Transformation** tab, administrators can tailor user attributes to specific requirements, streamline authentication, and improve overall system efficiency. Use the sample scripts above as a starting point for your own transformations.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/admin-portal/directory-integrations/user-attribute-transformation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.