Scenario 1: Attribute mapping for the entries in an authentication server

You can configure attribute mapping for the user entries that do not contain credentials in the authentication server.

In this scenario, you must identify an attribute in the authentication server that contains unique values for all entries. You must also find an attribute in the pass-through server that you can map uniquely with the attribute in authentication server for all entries. It is not necessary that the name of an attribute is identical in both the servers.

The attribute that you identify to map from the authentication server to the pass-through server must contain unique values. Using this attribute, you must be able to map all entries in the authentication server that require pass-through authentication to entries in the pass-through server. For example, you can map uid=Tom456 in the authentication server with userPrincipalName=Tom456 in the pass-through server. After you set the attribute mapping, a search against the pass-through server with the userPrincipalName=Tom456 filter must retrieve only one matching entry. If more that one entry is returned, then the pass-through authentication might fail and generate an error message.

In this scenario, the following conditions might occur on the authentication server:

• An attribute with a unique value exists in the authentication server and a matching attribute with a unique value exists in the pass-through server.
• An attribute with a unique value does not exist in the authentication server.