In Gluu 4, there is a feature called "Cache Refresh", https://gluu.org/docs/gluu-server/4.4/user-management/ldap-sync/ That could be one way.

Hi, Janis. There are few options. As Michael pointed out above, if the source of your users is some kind of external LDAP server, you could use Cache Refresh in Gluu to import the users, and custom scripts to transform their attributes any way you like. As for your situation, if you have to add them via Import feature, you could try to write custom script of "Update user" type you can find on the similar named tab at "Configuration" > "Manage Custom scripts" page. Please note that writing custom scripts isn't covered by Community Support. It shouldn't be hard to figure it out though, if you are familiar with Java and Python.

Right, they could use the Cache Refresh script and populate the `role` attribute or the `memberOf` attribute. BTW, we disable referential integrity by default in OpenDJ ``` dn: cn=Referential Integrity,cn=Plugins,cn=config cn: Referential Integrity ds-cfg-attribute-type: member ds-cfg-attribute-type: uniqueMember ds-cfg-enabled: false ds-cfg-invoke-for-internal-operations: true ds-cfg-java-class: org.opends.server.plugins.ReferentialIntegrityPlugin ds-cfg-plugin-type: postOperationDelete ds-cfg-plugin-type: postOperationModifyDN ds-cfg-plugin-type: subordinateDelete ds-cfg-plugin-type: subordinateModifyDN objectClass: ds-cfg-plugin objectClass: ds-cfg-referential-integrity-plugin objectClass: top ```

Hello, sorry for delay. Thank you for ideas. Unfortunately is not ldap/ad compatible system we need to import users from. So we cannot use cache refresh. Update user custom script was also considered as option. In the end we decided to write small app for enduser import, which use SCIM API.