1. Select a sub-attribute from the Attribute ID list.

    Applicable only to complex attributes or complex multivalued attributes, see Specifying custom SCIM attributes.

  2. Select the class containing a user-store attribute under Root Object Class that you want to map to the provisioning attribute shown under Field Name.

    For some fields, you might not need to map specific user attributes. If so, supply a value in the Default Value field instead, skip this step, and go to step 5.For certain attributes, you can specify both LDAP attributes and a default value, as needed.

  3. Select the source attribute from the class under LDAP Attribute. Click Add Attribute.
  4. Select one or more processing options.
    Processing optionDescription
    Create Only
    The field is provisioned only once and not subsequently updated.

    For SCIM, the Password attribute should be passed only when creating a user or updating the password. Select Create Only to limit when the Password attribute is passed.

    Trim Removes any white space from the attribute values.
    Mask Log Values Determines whether sensitive information, such as the Password attribute, will be masked in PingFederate log files.
    Upper Case, Lower Case, or None Transforms the attribute values to the case indicated unless the None option is selected, the default.
    Parsing > Extract CN from DN For attributes in the form of a distinguished name (DN), such as Group DNs in Active Directory, maps only the common name portion of the DN.
    Parsing > Extract Username from Email For attributes containing an email address, maps only the username.
  5. Enter a default value.
  6. Click Add Mapping.

    For complex attributes or complex multivalued attributes, repeat these steps to map additional sub-attributes as needed.

  7. Click Done.