Directory Server Attributes Synchronized for AuthenticationDirectory Server Attributes Synchronized for Authentication
You must enable synchronization for identity source attributes if you want users to authenticate through the Cloud Authentication Service. For details, see:
To configure identity source attributes, see Add an Identity Source.
Active Directory Attributes Synchronized for AuthenticationActive Directory Attributes Synchronized for Authentication
When you add an Active Directory identity source, the attributes in the following table are mapped to their corresponding attributes in Active Directory. The table shows the default mapping, but you can customize the mapping.
If you want Active Directory users to authenticate through the Cloud Authentication Service, you must enable synchronization for these attributes. See Where to Enable Attribute Synchronization for more information.
Field Name in the Cloud Administration Console | Attribute Name in Active Directory | Usage |
---|---|---|
First Name | givenName | User's first name |
Last Name | sn | User's last name |
Email Address | User's email address/User ID | |
Primary Username |
sAMAccountName |
Primary user identifier for multifactor authentication through the Cloud Authentication Service, including SecurID, RADIUS, and third-party MFA clients. Typically, this is a short username, such as jdoe. |
Primary Unique Identifier | distinguishedName | Used during device registration, LDAP password authentication (including primary authentication for relying parties and RADIUS), FIDO registration, and identity source synchronization. |
Secondary Unique Identifier | objectGUID | Used to identify users during synchronization. |
User Account Status | userAccountControl | Indicates whether a user is enabled or disabled in Active Directory. A disabled user cannot authenticate using the Cloud Authentication Service. |
User Account Expiration | accountExpires |
Indicates when the user’s Active Directory account expires, if applicable. An expired user is disabled in the Cloud Authentication Service and cannot authenticate. Note: If you are synchronizing from an Active Directory Global Catalog, SecurID recommends that, in the directory server, you configure accountExpires to be replicated to the Active Directory Global Catalog. This ensures that user enablement status in the Cloud Authentication Service is synchronized with Active Directory. |
LDAPv3 Directory Server Attributes Synchronized for Authentication LDAPv3 Directory Server Attributes Synchronized for Authentication
If you want LDAPv3 users to authenticate through the Cloud Authentication Service, you must do the following when you add an identity source:
-
Map each of the following user attributes to its corresponding attribute in your LDAPv3 directory server.
-
Enable synchronization for these attributes. See Where to Enable Attribute Synchronization for more information.
Cloud Authentication Service Attribute Name | Attribute Value | Name of Recommended Attribute in LDAPv3 Directory Server | |||
---|---|---|---|---|---|
Oracle Directory Server | Apache Directory Server | OpenDJ | OpenLDAP | ||
First Name | User's first name. | givenName | givenName | givenName | givenName |
Last Name | User's last name. | sn | sn | sn | sn |
Email Address |
User's email address. Note: This attribute must be named mail and must be in the LDAP directory's inetOrgPerson objectClass. |
||||
Primary Username |
Primary user identifier for multifactor authentication through the Cloud Authentication Service, including SecurID, RADIUS, and third-party MFA clients. Typically, this is a short username, such as jdoe. |
uid | uid | uid | uid |
Primary Unique Identifier | A unique identifying value (DN) for the user. | entryDN | entryDN | entryDN | entrydn |
Secondary Unique Identifier | A unique and stable identifier for the user. The value of the Secondary Unique Identifier must not change, even if the user's name, email address, or DN changes over time. | nsUniqueId | entryUUID | entryUUID | nsUniqueId |
User Account Status |
Indicates whether a user is enabled or disabled in the directory server. A disabled user cannot authenticate using the Cloud Authentication Service. If you cannot use a recommended attribute, map to a similar boolean attribute. The Cloud Authentication Service treats the TRUE value as disabled status and FALSE value as enabled status. |
nsAccountLock | pwdAccountLockedTime | ds-pwp-account-disabled | pwdAccountLockedTime |
User Account Expiration | Indicates when the user’s directory server account expires, if applicable. An expired user is disabled in the Cloud Authentication Service and cannot authenticate. Also see User Account Expiration Attributes for LDAPv3 Directory Servers. | N/A | N/A | ds-pwp-account-expiration-time attribute. | N/A |
Optional AttributesOptional Attributes
The following attributes are synchronized if you configure them when you add an identity source. This applies to both Active Directory and LDAPv3 directory servers. These attributes are intended only for specific environments.
Attribute | Usage |
---|---|
SMS Tokencode Phone Number | LDAP attribute used to identify a user's mobile phone number that can receive text messages for SMS OTP. SMS Tokencode is a six-digit code that the Cloud Authentication Service sends to the user's phone in an SMS message when the user attempts to access an application. |
Voice Tokencode Phone Number | LDAP attribute used to identify a user's phone number for Voice OTP. Voice Tokencode is a six-digit code that the Cloud Authentication Service provides by calling the user's phone when the user attempts to access an application. |
Alternate Username |
An attribute that can be used as an additional user identifier. For example, you can use this attribute for the Active Directory userPrincipalName. This attribute can be used with all applications protected by the Cloud Authentication Service except those in IDR SSO Agent deployments. This feature is useful for relying party deployments that need to provide multiple ways for users to specify their usernames. If configured, users can provide either primary or alternate username and be correctly identified. |
User Account Expiration Attributes for LDAPv3 Directory ServersUser Account Expiration Attributes for LDAPv3 Directory Servers
If your directory server tracks expired user accounts through an LDAP attribute, you can map User Account Expiration to any attribute that accepts a value in LDAP GeneralizedTime type format, as described in https://tools.ietf.org/html/rfc4517#page-13. The time reflects the user's account end date. If detection is unsupported, leave this attribute blank. If you do not map this attribute or the value is blank, the Cloud Authentication Service assumes the account is not expired.
Where to Enable Attribute SynchronizationWhere to Enable Attribute Synchronization
You enable attribute synchronization when you add an identity source on the Users > Identity Source wizard pages.
If you want to do this... | You must select... |
---|---|
Allow users to use the Cloud Authentication Service |
Synchronize user attributes on the Synchronize User Attributes page. These attributes are used to validate user authentication requests and register devices. Synchronization is required for RADIUS and relying party deployments. For IDR SSO Agent deployments, synchronization is required if at least one application is protected by a policy that requires additional authentication. If only password authentication is used, you do not need to synchronize. Synchronization is also required if you configured the application portal or the Cloud Administration Console to require additional authentication. |
Set up access policy rules to identify the target population based on user attributes for non-SSO Agent use cases. |
Synchronize the selected policy attributes with the Cloud Authentication Service on the User Attributes page, and also select which attributes you want to synchronize. Selecting this option automatically enables the Synchronize user attributes checkbox to synchronize the authentication attributes listed in the previous table. |
Note: In IDR SSO Agent deployments, access policies are evaluated on the identity router, so you do not need to select attributes on the User Attributes page for synchronization.
Related Concepts
Identity Sources for the Cloud Authentication Service
Related Tasks
Add, Delete, and Test the Connection for an Identity Source in the Cloud Authentication Service
Manually (Bulk) Synchronize an Identity Source for the Cloud Authentication Service
Schedule Identity Source Synchronization for the Cloud Authentication Service
Related References
LDAPv3 Server Requirements to Enable Expired Password Handling in the Application Portal
Manage Identity Sources for the Cloud Authentication Service