PingFederate provides an advanced option allowing administrators to map user attributes by way of an expression language. To enable use of expressions in PingFederate, see Enabling and disabling expressions in the PingFederate documentation.

For example, if you have an attribute mapping that maps the Account ID field to the objectSid attribute in Active Directory, then PingFederate will Base64-encode that binary data into a string.

  1. On the Attribute Mapping tab, for the appropriate attribute click Edit.
  2. On the Specify Attribute Mapping tab, enter the appropriate expression in the Expression field.

    You can use the following OGNL expression to encode the objectSid attribute in SID format:

    #sidBinary = @java.util.Base64@getDecoder().decode(#this.get("objectSid").toString()),

#sidHex = @String@format("%056x", new java.math.BigInteger(1, #sidBinary)),

#SID = #sidHex.substring(16),
#i = new Long(0),
#subAuths=#SID.split("(?<=\\G.{8})"),
#result="S-1-5",
#subAuths.{
  #BE = #this.substring(6,8) + #this.substring(4,6) + #this.substring(2,4) + #this.substring(0,2),  
  #DEC = #i.parseLong(#BE,16),
  #result = #result + "-" + #DEC
},
#result
  3. Click Save.