Directory Server Attributes Synchronized for Authentication

You must enable synchronization for identity source attributes if you want users to authenticate through the Cloud Access Service (CAS). For details, see:

Active Directory Attributes Synchronized for Authentication
LDAPv3 Directory Server Attributes Synchronized for Authentication
Optional Attributes
Where to Enable Attribute Synchronization

To configure identity source attributes, see Add an Identity Source.

Active Directory Attributes Synchronized for Authentication

When you add an Active Directory identity source, the attributes in the following table are mapped to their corresponding attributes in Active Directory. The table shows the default mapping, but you can customize the mapping.

If you want Active Directory users to authenticate through CAS, you must enable synchronization for these attributes. See Where to Enable Attribute Synchronization for more information.

Field Name in the Cloud Administration Console	Attribute Name in Active Directory	Usage
First Name	givenName	User's first name
Last Name	sn	User's last name
Email Address	mail	User's email address/User ID
Primary Username	sAMAccountName	Primary user identifier for multifactor authentication through CAS, including SecurID, RADIUS, and third-party MFA clients. Typically, this is a short username, such as jdoe.
Primary Unique Identifier	distinguishedName	Used during device registration, LDAP password authentication (including primary authentication for relying parties and RADIUS), FIDO registration, and identity source synchronization.
Secondary Unique Identifier	objectGUID	Used to identify users during synchronization.
User Account Status	userAccountControl	Indicates whether a user is enabled or disabled in Active Directory. A disabled user cannot authenticate using CAS.
User Account Expiration	accountExpires	Indicates when the user’s Active Directory account expires, if applicable. An expired user is disabled in the CAS and cannot authenticate. Note: If you are synchronizing from an Active Directory Global Catalog, RSA recommends that, in the directory server, you configure accountExpires to be replicated to the Active Directory Global Catalog. This ensures that user enablement status in CAS is synchronized with Active Directory.

LDAPv3 Directory Server Attributes Synchronized for Authentication

If you want LDAPv3 users to authenticate through CAS, you must do the following when you add an identity source:

Map each of the following user attributes to its corresponding attribute in your LDAPv3 directory server.
Enable synchronization for these attributes. See Where to Enable Attribute Synchronization for more information.

CASAttribute Name	Attribute Value	Name of Recommended Attribute in LDAPv3 Directory Server
CASAttribute Name	Attribute Value	Oracle Directory Server	Apache Directory Server	OpenDJ	OpenLDAP
First Name	User's first name.	givenName	givenName	givenName	givenName
Last Name	User's last name.	sn	sn	sn	sn
Email Address	User's email address. Note: This attribute must be named mail and must be in the LDAP directory's inetOrgPerson objectClass.	mail	mail	mail	mail
SecurID Username Primary Username	Primary user identifier for multifactor authentication through the Cloud Access Service, including SecurID, RADIUS, and third-party MFA clients. Typically, this is a short username, such as jdoe.	uid	uid	uid	uid
Primary Unique Identifier	A unique identifying value (DN) for the user.	entryDN	entryDN	entryDN	entrydn
Secondary Unique Identifier	A unique and stable identifier for the user. The value of the Secondary Unique Identifier must not change, even if the user's name, email address, or DN changes over time.	nsUniqueId	entryUUID	entryUUID	nsUniqueId
User Account Status	Indicates whether a user is enabled or disabled in the directory server. A disabled user cannot authenticate using CAS. If you cannot use a recommended attribute, map to a similar boolean attribute. CAS treats the TRUE value as disabled status and FALSE value as enabled status.	nsAccountLock	pwdAccountLockedTime	ds-pwp-account-disabled	pwdAccountLockedTime
User Account Expiration	Indicates when the user’s directory server account expires, if applicable. An expired user is disabled in CAS and cannot authenticate. Also see User Account Expiration Attributes for LDAPv3 Directory Servers.	N/A	N/A	ds-pwp-account-expiration-time attribute.	N/A

Optional Attributes

The following attributes are synchronized if you configure them when you add an identity source. This applies to both Active Directory and LDAPv3 directory servers. These attributes are intended only for specific environments.

Attribute	Usage
SMS Tokencode Phone Number	LDAP attribute used to identify a user's mobile phone number that can receive text messages for SMS OTP. SMS Tokencode is a six-digit code that CAS sends to the user's phone in an SMS message when the user attempts to access an application.
Voice Tokencode Phone Number	LDAP attribute used to identify a user's phone number for Voice OTP. Voice Tokencode is a six-digit code that CAS provides by calling the user's phone when the user attempts to access an application.
Alternate Username	An attribute that can be used as an additional user identifier. For example, you can use this attribute for the Active Directory userPrincipalName. This attribute can be used with all applications protected by CAS except those in IDR SSO Agent deployments. This feature is useful for relying party deployments that need to provide multiple ways for users to specify their usernames. If configured, users can provide either primary or alternate username and be correctly identified.
Manager	An attribute that is used as a distinguished name of the user's manager.

User Account Expiration Attributes for LDAPv3 Directory Servers

If your directory server tracks expired user accounts through an LDAP attribute, you can map User Account Expiration to any attribute that accepts a value in LDAP GeneralizedTime type format, as described in https://tools.ietf.org/html/rfc4517#page-13. The time reflects the user's account end date. If detection is unsupported, leave this attribute blank. If you do not map this attribute or the value is blank, CAS assumes the account is not expired.

Where to Enable Attribute Synchronization

You enable attribute synchronization when you add an identity source on the Users > Identity Source wizard pages.

If you want to do this...	You must select...
Allow users to use CAS	Synchronize user attributes on the Synchronize User Attributes page. These attributes are used to validate user authentication requests and register devices. Synchronization is required for RADIUS and relying party deployments. For IDR SSO Agent deployments, synchronization is required if at least one application is protected by a policy that requires additional authentication. If only password authentication is used, you do not need to synchronize. Synchronization is also required if you configured the application portal or the Cloud Administration Console to require additional authentication.
Set up access policy rules to identify the target population based on user attributes for non-SSO Agent use cases.	Synchronize the selected attributes with the Cloud Authentication Service on the User Attributes page, and also select which attributes you want to synchronize. Selecting this option automatically enables the Synchronize user attributes checkbox to synchronize the authentication attributes listed in the previous table. This synchronization is required for RADIUS deployments, RADIUS Return List Attributes, My Page My Applications SAML NameID and statement attributes, IDR SSO Agent SAML NameID and attribute extension, Custom Headers attributes for My Page, IDR SSO Agent Trusted Headers, and HTTP Federation applications.

If you want to do this...

You must select...

Allow users to use CAS

Synchronize user attributes on the Synchronize User Attributes page. These attributes are used to validate user authentication requests and register devices. Synchronization is required for RADIUS and relying party deployments.

For IDR SSO Agent deployments, synchronization is required if at least one application is protected by a policy that requires additional authentication. If only password authentication is used, you do not need to synchronize.

Synchronization is also required if you configured the application portal or the Cloud Administration Console to require additional authentication.

Set up access policy rules to identify the target population based on user attributes for non-SSO Agent use cases.

Synchronize the selected attributes with the Cloud Authentication Service on the User Attributes page, and also select which attributes you want to synchronize. Selecting this option automatically enables the Synchronize user attributes checkbox to synchronize the authentication attributes listed in the previous table. This synchronization is required for RADIUS deployments, RADIUS Return List Attributes, My Page My Applications SAML NameID and statement attributes, IDR SSO Agent SAML NameID and attribute extension, Custom Headers attributes for My Page, IDR SSO Agent Trusted Headers, and HTTP Federation applications.

Note: For IDR SSO Agent authentications, access policies are evaluated on the identity router, so you do not need to select attributes to synchronize on the User Attributes page for access policies used only by the IDR SSO Agent.

Manually (Bulk) Synchronize an Identity Source for Cloud Access Service

Reference Materials

LDAPv3 Server Requirements to Enable Expired Password Handling in the Application Portal

Identity Sources for Cloud Access Service

Don't see what you're looking for?

Potential Impact from Salesforce Device Activation Change