Directory Server Attributes Synchronized for Authentication

You must enable synchronization for identity source attributes if you want users to authenticate through the Cloud Authentication Service. For details, see:

To configure identity source attributes, see Add an Identity Source.

Active Directory Attributes Synchronized for Authentication

When you add an Active Directory identity source, the attributes in the following table are mapped to their corresponding attributes in Active Directory. The table shows the default mapping, but you can customize the mapping.

If you want Active Directory users to authenticate through the Cloud Authentication Service, you must enable synchronization for these attributes. See Where to Enable Attribute Synchronization for more information.

Field Name in the Cloud Administration Console Attribute Name in Active Directory Usage
First Name givenName User's first name
Last Name sn User's last name
Email Address mail User's email address/User ID

Primary Username

sAMAccountName

Primary user identifier for multifactor authentication through the Cloud Authentication Service, including SecurID, RADIUS, and third-party MFA clients. Typically, this is a short username, such as jdoe.
Primary Unique Identifier distinguishedName Used during device registration, LDAP password authentication (including primary authentication for relying parties and RADIUS), FIDO registration, and identity source synchronization.
Secondary Unique Identifier objectGUID Used to identify users during synchronization.
User Account Status userAccountControl Indicates whether a user is enabled or disabled in Active Directory. A disabled user cannot authenticate using the Cloud Authentication Service.
User Account Expiration accountExpires

Indicates when the user’s Active Directory account expires, if applicable. An expired user is disabled in the Cloud Authentication Service and cannot authenticate.

Note: If you are synchronizing from an Active Directory Global Catalog, SecurID recommends that, in the directory server, you configure accountExpires to be replicated to the Active Directory Global Catalog. This ensures that user enablement status in the Cloud Authentication Service is synchronized with Active Directory.

LDAPv3 Directory Server Attributes Synchronized for Authentication

If you want LDAPv3 users to authenticate through the Cloud Authentication Service, you must do the following when you add an identity source:

  • Map each of the following user attributes to its corresponding attribute in your LDAPv3 directory server.

  • Enable synchronization for these attributes. See Where to Enable Attribute Synchronization for more information.

Cloud Authentication Service Attribute Name Attribute Value Name of Recommended Attribute in LDAPv3 Directory Server
Oracle Directory Server Apache Directory Server OpenDJ OpenLDAP
First Name User's first name. givenName givenName givenName givenName
Last Name User's last name. sn sn sn sn
Email Address

User's email address.

Note: This attribute must be named mail and must be in the LDAP directory's inetOrgPerson objectClass.

 mail mail mail mail

Primary Username

Primary user identifier for multifactor authentication through the Cloud Authentication Service, including SecurID, RADIUS, and third-party MFA clients. Typically, this is a short username, such as jdoe.

 uid uid uid uid
Primary Unique Identifier A unique identifying value (DN) for the user. entryDN entryDN entryDN entrydn
Secondary Unique Identifier A unique and stable identifier for the user. The value of the Secondary Unique Identifier must not change, even if the user's name, email address, or DN changes over time. nsUniqueId entryUUID entryUUID nsUniqueId
User Account Status

Indicates whether a user is enabled or disabled in the directory server. A disabled user cannot authenticate using the Cloud Authentication Service.

If you cannot use a recommended attribute, map to a similar boolean attribute. The Cloud Authentication Service treats the TRUE value as disabled status and FALSE value as enabled status.

 nsAccountLock pwdAccountLockedTime ds-pwp-account-disabled pwdAccountLockedTime
User Account Expiration Indicates when the user’s directory server account expires, if applicable. An expired user is disabled in the Cloud Authentication Service and cannot authenticate. Also see User Account Expiration Attributes for LDAPv3 Directory Servers. N/A N/A ds-pwp-account-expiration-time attribute. N/A

Optional Attributes

The following attributes are synchronized if you configure them when you add an identity source. This applies to both Active Directory and LDAPv3 directory servers. These attributes are intended only for specific environments.

Attribute Usage
SMS Tokencode Phone Number LDAP attribute used to identify a user's mobile phone number that can receive text messages for SMS OTP. SMS Tokencode is a six-digit code that the Cloud Authentication Service sends to the user's phone in an SMS message when the user attempts to access an application.
Voice Tokencode Phone Number LDAP attribute used to identify a user's phone number for Voice OTP. Voice Tokencode is a six-digit code that the Cloud Authentication Service provides by calling the user's phone when the user attempts to access an application.
Alternate Username

An attribute that can be used as an additional user identifier. For example, you can use this attribute for the Active Directory userPrincipalName. This attribute can be used with all applications protected by the Cloud Authentication Service except those in IDR SSO Agent deployments.

This feature is useful for relying party deployments that need to provide multiple ways for users to specify their usernames. If configured, users can provide either primary or alternate username and be correctly identified.

User Account Expiration Attributes for LDAPv3 Directory Servers

If your directory server tracks expired user accounts through an LDAP attribute, you can map User Account Expiration to any attribute that accepts a value in LDAP GeneralizedTime type format, as described in https://tools.ietf.org/html/rfc4517#page-13. The time reflects the user's account end date. If detection is unsupported, leave this attribute blank. If you do not map this attribute or the value is blank, the Cloud Authentication Service assumes the account is not expired.

Where to Enable Attribute Synchronization

You enable attribute synchronization when you add an identity source on the Users > Identity Source wizard pages.

If you want to do this... You must select...
Allow users to use the Cloud Authentication Service

Synchronize user attributes on the Synchronize User Attributes page. These attributes are used to validate user authentication requests and register devices. Synchronization is required for RADIUS and relying party deployments.

For IDR SSO Agent deployments, synchronization is required if at least one application is protected by a policy that requires additional authentication. If only password authentication is used, you do not need to synchronize.

Synchronization is also required if you configured the application portal or the Cloud Administration Console to require additional authentication.

Set up access policy rules to identify the target population based on user attributes for non-SSO Agent use cases.

Synchronize the selected policy attributes with the Cloud Authentication Service on the User Attributes page, and also select which attributes you want to synchronize. Selecting this option automatically enables the Synchronize user attributes checkbox to synchronize the authentication attributes listed in the previous table.

Note: In IDR SSO Agent deployments, access policies are evaluated on the identity router, so you do not need to select attributes on the User Attributes page for synchronization.

Related Concepts

Identity Sources for the Cloud Authentication Service

Related Tasks

Add, Delete, and Test the Connection for an Identity Source in the Cloud Authentication Service

Manually (Bulk) Synchronize an Identity Source for the Cloud Authentication Service

Schedule Identity Source Synchronization for the Cloud Authentication Service

Related References

LDAPv3 Server Requirements to Enable Expired Password Handling in the Application Portal

Manage Identity Sources for the Cloud Authentication Service