Setting Multiple Possible Values for AD/LDAP Profile Attributes

Last Updated: Sep 10, 2025

Overview

We have a requirement to check if a new Active Directory attribute: otherEmail has a value then use this value to map to the 'email' field otherwise if the new Active Directory attribute: otherEmail is empty (null) then map the 'email' field to the value of Active Directory Email attribute.

i.e.
If Active Directory otherEmail = $null
then email = Active Directory Email
else email = Active Directory otherEmail

Applies To

AD/LDAP
Profile Attributes

Solution

In this case, you can do the mappings in the profileMapper, so that this mapping logic is completely invisible to Auth0, which will only see an “email” (regardless of how it was calculated), as you can see here: https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/active-directory-ldap/ad-ldap-connector/map-ad-ldap-profile-attributes-to-auth0 and https://github.com/auth0/ad-ldap-connector/blob/master/lib/profileMapper.js#L11

You'd want to do something similar to the following:

emails: raw_data.otherEmail ? [{value: raw_data.otherEmail }] : (raw_data.mail ? [{value: raw_data.mail }] : undefined)