Policy Server Guides › Policy Server Configuration Guide › Authentication Schemes › Certificate Mapping › Custom Certificate Mapping for Multiple Attributes of the Same Type › Map to Non-Required Attributes

Map to Non-Required Attributes

Sometimes certificates for individuals may be slightly different. For example, some users may have two account numbers, while others have a single number. In these cases, you may want to map to the second of the numbers when a second attribute exists. You can do so using the following notation:

%{attribute_name2/attribute_name}

Using the example from above, you could enter %{SN2/SN} as a custom mapping to indicate that the second number in the Subject DN should be used if it exists, otherwise, the first occurrence of the account number attribute should be used.

This notation can also be used to specify two different attributes that are acceptable for a certificate mapping. For example, to indicate that the SN should be used, but a CN may be used if the SN does not exist, you could enter %{SN/CN}.