Case 2: An entry in the authentication server cannot be mapped to an entry in the pass-through server

If there is no unique attribute in the authentication server to map, you can set the DN value as the map.

You must be aware of the DN in the authentication server, which can be mapped to an entry in the pass-through server. To use the DN as the map value, you must set the ibm-PtaLinkAttribute attribute to _DN_. You must set the ibm-PtaLinkValue attribute value to the DN of the entry in the pass-through server that you want to map. When a user attempts to authenticate, the pass-through interface takes the specified DN value and the provided credentials to validate the user.

The following example shows an entry with ibm-PtaLinkAttribute set to _DN_:

dn: cn=Tom Brown1,o=sample
uid:Tom396
cn: Tom
sn: Brown1
objectclass: inetOrgPerson
objectclass: organizationalPerson
objectclass: person
objectclass: top
objectclass: ibm-ptaReferral
ibm-ptaLinkAttribute: _DN_
ibm-ptaLinkValue: cn=Tom456,cn=users,dc=pta,dc=com

If you do not want to provide pass-through support for an entry that is set with DN value, you must set ibm-PtaLinkAttribute to _DISABLE_.