Transcribes

Transcribes configuration using object syntax.

Each key under transcribes is a transcribe type (e.g., "user", "group"). Transcribes are processed in alphabetical order (case-insensitive) for deterministic behavior. Use the Attribute Modeling guide when deciding which relationship attributes to store and which reverse views to compute.

Example:

transcribes {
  user {
    ldap {
      base = "ou=users,o=data"
      filter = "(objectClass=Person)"
    }
    indices {
      partial-match = "cn, sn, description"
    }
  }
  group {
    ldap {
      base = "ou=groups,o=data"
      filter = "(objectClass=groupOfNames)"
    }
  }
}

Legacy array syntax is deprecated but still supported:

transcribes = [
  { type = "user", ldap { base = "ou=users,o=data" } }
]

Enable or disable this transcribe. Can be set via environment variables:

• SCRIBE_TRANSCRIBE_ENABLED (applies to all)
• SCRIBE_TRANSCRIBE_<TYPE>_ENABLED (per-type, e.g., SCRIBE_TRANSCRIBE_USER_ENABLED)

Values: true, false, 1, 0, yes, no If readonly mode is active, this is always false.

transcribes.<type>.enabled = true

When the directory publishes its schema, IdentityScribe automatically recognizes the structural subclasses of each transcribe's object class, so a query that filters on a more specific class still routes to this transcribe. A transcribe filtered by (objectClass=person), for example, also answers inbound (objectClass=inetOrgPerson) and (structuralObjectClass=inetOrgPerson) queries with no extra configuration.

This applies to inbound routing only, on the same terms as the manual aliases above. If the directory schema is unavailable, or any transcribe filter has no objectClass term, automatic recognition turns itself off and logs the reason — list the classes in object-class-aliases to match them manually. Index configuration for this transcribe.

Indices defined here merge with root-level indices.*, with transcribe-level taking precedence.

See Indices for all available options.

Attributes for contains, ends-with, and fuzzy queries. Trigram indexes — 5–15× larger and slower to write than equality indexes. No baseline defaults; opt-in per attribute. Starts-with queries use value-match instead. Typeahead pack: "cn, sn, givenName, displayName"

transcribes.<type>.indices.partial-match = null

Attributes for sort and range queries. Baseline defaults (cn, sn, displayName, mail, uid) are automatically included for observed attributes. Group-membership attributes are equality-only; add memberOf/nrfMemberOf here only if you sort by them. For relationship direction guidance, see Attribute Modeling.

Example: "cn, displayName"

transcribes.<type>.indices.sortable = null

Attributes for equality and prefix-match (startsWith) queries. Baseline defaults (objectClass, cn, sn, ou, uid, mail, displayName, member, memberOf, nrfMemberOf, ...) are automatically included for observed attributes. Choose the stored relationship side before adding coverage: Attribute Modeling.

Example: "cn, uid, mail, nrfMemberOf"

transcribes.<type>.indices.value-match = null

LDAP configuration for this transcribe.

Merged with the shared ldap {} configuration. See Ldap for all available options.

Attributes to retrieve for each entry. Can be a comma-separated string or HOCON list. For relationship attributes, store the side with the smaller per-entry value set and expose reverse views with virtual attributes.

See Attribute Modeling.

Example:

attributes = "cn, sn, mail, telephoneNumber"

transcribes.<type>.ldap.attributes = null

Base DN to search for entries.

Example: "ou=users,o=data"

transcribes.<type>.ldap.base = null

LDAP filter for searching entries.

Example: "(objectClass=Person)"

transcribes.<type>.ldap.filter = null

Extra objectClass values that identify this transcribe's entries, used for INBOUND query routing only. When a query filters on one of these classes, IdentityScribe treats it as a match for this transcribe, in addition to the classes in the type filter above. Use it when clients query by a class name the filter does not list. Values are matched case-insensitively; a value shared by every configured transcribe is ignored. INBOUND ROUTING ONLY — never sent to the directory, never affects what is synced or stored, and never excludes this transcribe from a negated (!(objectClass=...)) filter. Can be a comma-separated string or a HOCON list.

Default: empty (no aliases declared).

Example:

object-class-aliases = "inetOrgPerson, organizationalPerson"

transcribes.<type>.ldap.object-class-aliases = null

Search scope.

Values: base, one, sub, subordinate_subtree

Default: sub

transcribes.<type>.ldap.scope = sub

Maximum concurrent tasks for this transcribe. Leave unset to derive from database connection pool. Set to 0 or negative to disable throttling (not recommended).

transcribes.<type>.max-task-concurrency = -1