Use this screen to map attribute values in the SCIM request to group attributes.

Contract Fulfillment
  1. Select a source from the list for each target attribute.
    • Context

      When selected, the Value list is populated with the available context of the transaction. Select the desired context from the list.


      The HTTP Request context value is retrieved as a Java object rather than text. For this reason, OGNL expressions are more appropriate to evaluate and return values.


      If you are configuring an OAuth Attribute Mapping configuration and PERSISTENT_GRANT_LIFETIME has been added as an extended attribute on the OAuth Server > Authorization Server Settings screen, you have the option to set the lifetime of persistent grants based on the outcome of attribute mapping expressions or the per-client Persistent Grants Max Lifetime setting.

      • To set lifetime based on the per-client Persistent Grants Max Lifetime setting, select Context as the source and Default Persistent Grant Lifetime as the value.
      • To set lifetime based on the outcome of attribute mapping expressions, select Expression as the source and enter an OGNL expression as the value.

        If the expression returns a positive integer, the value represents the lifetime of the persistent grant in minutes.

        If the expression returns the integer 0, PingFederate does not store the grant and does not issue refresh token.

        If the expression returns any other value, PingFederate sets the lifetime of the persistent grant based on the per-client Persistent Grants Max Lifetime setting.

      • To set a static lifetime, select Text as the source and enter a static value.

        This is most suitable for testing purposes or use cases where the persistent grant lifetime must always be set to a certain value in some specific grant-mapping configurations.

    • Expression

      If you have not already done so, you may enable OGNL expression by editing the org.sourceid.common.ExpressionManager.xml file in the <pf_install>/pingfederate/server/default/data/config-store directory. Restart PingFederate after saving the change.

      For a clustered PingFederate environment, edit the org.sourceid.common.ExpressionManager.xml file on the console node, sign on to the administrative console to replicate this change to all engine nodes on the System > Cluster Management screen, and restart all nodes.

      This option provides more complex mapping capabilities; for example, transforming incoming values into different formats. All of the variables available for text entries (see below) are also available for expressions.

      If two attribute values from a SCIM request need to be mapped to one LDAP attribute value, use an OGNL expression to create it.

    • SCIM Group

      When you make this selection, the associated Value drop-down list is populated by defined components of the SCIM request.

    • No Mapping

      Select this option to ignore the Value field, causing no value selection to be necessary.

    • Text

      The value is what you enter. This can be text only, or you can mix text with references to any of the values from the SCIM request, using the ${attribute} syntax.

  2. Select (or enter) an attribute value.
    All target attributes must be mapped.
  3. Click .