--- title: Correlated LDAP data views description: Correlated LDAP data views can be attached to a System for Cross-domain Identity Management (SCIM) resource type to allow that resource type to use attributes from other LDAP entries. A SCIM resource type can have multiple data views configured. component: pingdirectory version: 11.1 page_id: pingdirectory:managing_scim:pd_proxy_correlated_ldap_data_views canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/managing_scim/pd_proxy_correlated_ldap_data_views.html llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-08-17T00:00:00Z page_aliases: ["managing_scim_11_and_20_servlet_extensions:pd_proxy_correlated_ldap_data_views.adoc"] section_ids: configuring-a-correlated-ldap-data-view: Configuring a correlated LDAP data view about-this-task: About this task steps: Steps --- # Correlated LDAP data views Correlated LDAP data views can be attached to a System for Cross-domain Identity Management (SCIM) *(tooltip: \
\

An application-level, HTTP-based protocol for provisioning and managing user identity information. SCIM supplies a common schema for representing users and groups and provides a REST API.\

\
)* resource type to allow that resource type to use attributes from other LDAP entries. A SCIM resource type can have multiple data views configured. Correlated LDAP data views share many configuration settings with SCIM resource types. The following are exceptions: * `primary-correlation-attribute`: The LDAP attribute from the SCIM resource type whose value will be used to match entries in the data view. This property must be defined. * `secondary-correlation-attribute`: The LDAP attribute from the data view whose value will be matched with the primary-correlation-attribute. This property must be defined. * `ldap-correlation-attribute-pair`: Optional correlation attribute pairs. If these are configured, entries between the SCIM resource type and the correlated LDAP data view must also have matching values for the specified attributes for them to be returned together. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | A correlated LDAP data view can't provide attributes from more than one LDAP entry at a time. If there are multiple LDAP entries with secondary-correlation-attribute values that match the primary-correlation-attribute from the SCIM resource type's entry, the server throws an error. | If the correlated LDAP data view is attached to a pass-through SCIM resource type, its attributes will appear as schema extensions, similar to the following: ```json { ... "uid": [ "user.8" ], "entryDN": "uid=user.8,ou=people,dc=example,dc=com", "urn:pingidentity:schemas:correlated:Document": { "documentIdentifier": [ "user.8" ], "description": [ "This is the description for the document user.8 under ou=Documents,dc=example,dc=com." ], ... }, ... "schemas": [ "urn:pingidentity:schemas:correlated:Document", "urn:pingidentity:schemas:passthrough:PassthroughUsers" ] } ``` If the correlated LDAP data view is attached to a Mapping SCIM resource type, its attributes must be mapped to a schema used by the SCIM resource type. This is done through the correlated-ldap-data-view property in a SCIM attribute mapping *(tooltip: \
\

Matching corresponding attributes between an IdP and an SP to identify federated users or add supplemental user information.\

\
)*. ## Configuring a correlated LDAP data view ### About this task The following example shows how to add a correlated LDAP data view to a LDAP mapping SCIM resource type on a PingDirectory server. The SCIM resource type will be a user, and the correlated LDAP data view will allow access to a document that matches their user ID. In this example, a new PingDirectory server is set up using custom sample data. When configuring the correlation, administrators should use attributes that are inherently either immutable or non-volatile, such as `uid` or `entryUUID`. This prevents errors produced by a conflict between the values of primary and secondary correlation attributes. | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Administrators can make the correlation SCIM attributes immutable by setting the `--set mutability:read-only` property when defining an attribute in the SCIM schema configuration. That way, SCIM requests can't modify the values of those attributes. | ### Steps 1. Copy the following text into the server root directory and save it as `entries.ldif.template`: ``` define suffix=dc=example,dc=com define maildomain=example.com define numusers=101 branch: [suffix] subordinateTemplate: admin:1 aci: (targetattr="*")(version 3.0; acl "Grant full access for the scim2allaccess OAuth 2 scope"; allow (all) oauthscope="scim2allaccess";) branch: ou=People,[suffix] subordinateTemplate: person:[numusers] branch: ou=Documents,[suffix] subordinateTemplate: document:[numusers] template: admin rdnAttr: uid objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson uid: admin givenName: Admin sn: User cn: Admin User userPassword: password template: person rdnAttr: uid objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson employeeNumber: uid: user.{employeeNumber} sn: {uid} cn: {uid} userPassword: password template: document rdnAttr: documentIdentifier objectClass: top objectClass: document documentIdentifier: user. description: This is the description for the document {documentIdentifier} under ou=Documents,dc=example,dc=com. ``` 2. Run the following command: ```shell $ bin/make-ldif --templateFile entries.ldif.template --ldifFile entries.ldif ``` 3. Run setup for the PingDirectory server. Make sure to import the created `entries.ldif` file and set up encryption settings. After this is done, set up the SCIM resource type and the correlated LDAP data view. 4. Run the following command to define the SCIM schema: ``` "dsconfig create-scim-schema --schema-name urn:example:Users \ --set "description:Users schema" --set display-name:Users dsconfig create-scim-attribute --schema-name urn:example:Users \ --attribute-name email --set required:true --set multi-valued:true dsconfig create-scim-attribute --schema-name urn:example:Users \ --attribute-name uid --set required:true --set mutability:read-only dsconfig create-scim-attribute --schema-name urn:example:Users \ --attribute-name documentId dsconfig create-scim-attribute --schema-name urn:example:Users \ --attribute-name documentDescription" ``` 5. Run the following command to create the SCIM resource type: ``` dsconfig create-scim-resource-type \ --type-name Users \ --type ldap-mapping \ --set core-schema:urn:example:Users \ --set enabled:true \ --set endpoint:Users \ --set structural-ldap-objectclass:inetOrgPerson \ --set include-base-dn:ou=people,dc=example,dc=com \ --set create-dn-pattern:entryUUID=generated,ou=people,dc=example,dc=com ``` 6. Run the following command to create the correlated LDAP data view: ``` dsconfig create-correlated-ldap-data-view \ --type-name Users \ --view-name Document \ --set structural-ldap-objectclass:document \ --set include-base-dn:ou=documents,dc=example,dc=com \ --set create-dn-pattern:entryUUID=generated,ou=documents,dc=example,dc=com \ --set primary-correlation-attribute:uid \ --set secondary-correlation-attribute:documentIdentifier ``` 7. Run the following command to create the attribute mappings for the SCIM resource type attributes. Note that the `correlated-ldap-data-view` property isn't set. ``` # The uid attribute, provided by the base SCIM resource type dsconfig create-scim-attribute-mapping --type-name Users \ --mapping-name uid \ --set scim-resource-type-attribute:uid --set ldap-attribute:uid \ --set writable:false --set searchable:true # The email attribute, provided by the base SCIM resource type dsconfig create-scim-attribute-mapping --type-name Users \ --mapping-name email \ --set scim-resource-type-attribute:email --set ldap-attribute:mail \ --set searchable:true ``` 8. Run the following command to create the `DocumentId` attribute mapping for the correlated LDAP data view attributes. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | The only meaningful difference between mappings for SCIM resource type attributes and correlated LDAP data view attributes is the value of the `correlated-ldap-data-view` property. | ``` # The documentId attribute dsconfig create-scim-attribute-mapping --type-name Users \ --mapping-name document.id \ --set correlated-ldap-data-view:Document \ --set scim-resource-type-attribute:documentId --set ldap-attribute:documentIdentifier # The documentDescription attribute dsconfig create-scim-attribute-mapping --type-name Users \ --mapping-name description \ --set correlated-ldap-data-view:Document \ --set scim-resource-type-attribute:documentDescription \ --set ldap-attribute:description ``` 9. Run the following command to send a SCIM request: ```shell curl -k -X GET \ https://localhost:8443/scim/v2/Users \ -H 'Authorization: Bearer {"active":true, "scope":"scim2allaccess"}' ``` The response should look similar to the following. Notice that `uid` and `documentId` have the same value, as they are in a correlation attribute pair. ```json { "schemas": [ "urn:ietf:params:scim:api:messages:2.0:ListResponse" ], "totalResults": 101, "Resources": [ { "uid": "user.8", "id": "3715c022-1f34-36d9-bebc-7e74912106ec", "documentDescription": "This is the description \ for the document user.8 under ou=Documents,dc=example,dc=com., "documentId": "user.8", "meta": { "resourceType": "Users", "location": "https://localhost:8443/scim/v2/Users/3715c022-1f34-36d9-bebc-7e74912106ec" }, "schemas": [ "urn:example:Users" ] }, ... } ```