---
title: The authorization identity request control
description: "Get the authenticated user's DN from a bind response with the authorization identity request control, useful for non-DN bind identities."
component: pingdirectory
version: 10.2
page_id: pingdirectory:pingdirectory_security_guide:pd_sec_authr_id_request_ctrl
canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_security_guide/pd_sec_authn_ctrls.html
llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2023-09-13T00:00:00Z
---

# The authorization identity request control

The authorization identity request control is described in [RFC 3829](https://www.ietf.org/rfc/rfc3829.txt) and can be included in a bind request to indicate that the server should include the resulting authorization identity in the successful bind response.

In the PingDirectory server, this authorization identity is always in the form of a distinguished name (DN), prefixed by `dn:` (for example, `dn:uid=jdoe`,`ou=People`,`dc=example`,`dc=com`).

This control is useful to determine the DN of the authenticated user entry, especially when the bind request does not identify the user by a DN, such as if the client was identified by a username, a Kerberos *(tooltip: \<div class="paragraph">
\<p>A network authentication protocol to provide strong authentication for client/server applications using symmetric key cryptography and a trusted authentication service (Key Distribution Center). The KDC authenticates the client and issues tickets allowing access to the server. Kerberos is the default authentication technology used by Microsoft.\</p>
\</div>)* principal, a client certificate, or an OAuth access token *(tooltip: \<div class="paragraph">
\<p>A data object by which a client authenticates to a resource server and lays claim to authorizations for accessing particular resources.\</p>
\</div>)*.