---
title: Authentication and authorization
description: Describes HTTP Basic authentication for the Configuration API and the identity mapper that resolves user names to DNs.
component: pingdirectory
version: 10.2
page_id: pingdirectory:pingdatasync_server_administration_guide:pd_sync_authn_authr
canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_server_administration_guide/pd_ds_authn_auth_config_api.html
llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2023-09-13T00:00:00Z
---

# Authentication and authorization

Clients must use HTTP Basic authentication to authenticate to the Configuration API. If the user name value is not a DN, then it will be resolved to a DN value using the identity mapper associated with the Configuration servlet. By default, the Configuration API uses an identity mapper that allows an entry's UID value to be used as a user name. To customize this behavior, either customize the default identity mapper, or specify a different identity mapper using the Configuration servlet's `identity-mapper` property. For example:

```shell
$ bin/dsconfig set-http-servlet-extension-prop \
  --extension-name Configuration \
  --set "identity-mapper:Alternative Identity Mapper"
```

To access configuration information, users must have the appropriate privileges:

* To access the `cn=config` backend, users must have the `bypass-acl` privilege or be allowed access to the configuration using an ACI.

* To read configuration information, users must have the `config-read` privilege.

* To update the configuration, users must have the `config-write` privilege.