# How to map two LDAP attributes to one user attribute **URL:** \ **Category:** Extending the server\ **Created:** [January 12, 2022, 1:42pm UTC](https://forum.keycloak.org/t/how-to-map-two-ldap-attributes-to-one-user-attribute/13012 "2022-01-12T13:42:23Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![dwi](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@dwi](https://forum.keycloak.org/u/dwi)\ **Post date:** [January 12, 2022, 1:42pm UTC](https://forum.keycloak.org/t/how-to-map-two-ldap-attributes-to-one-user-attribute/13012/1 "2022-01-12T13:42:23Z")
I want to map two LDAP attributes to a single user attribute. As a starting point I would use UserAttributeLDAPStorageMapper. But this class is spefically for mapping exactly one LDAP attribute to one user attribute. I only need this mapping as read-only transformation from LDAP to user attribute. I don’t need any updates of the LDAP attributes. Am I correct in assuming that I only need the methods onImportUserFromLDAP() and beforeLDAPQuery(). I think I should throw an exception in method onRegisterUserToLDAP(), right? But what about the method proxy()? I want to always read from LDAP so I need to remove all code for writing and only leave the code for isAlwaysReadValueFromLDAP, correct? ---
**Author:** ![semangard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/semangard/32/1922_2.png) [@semangard](https://forum.keycloak.org/u/semangard)\ **Post date:** [January 12, 2022, 3:12pm UTC](https://forum.keycloak.org/t/how-to-map-two-ldap-attributes-to-one-user-attribute/13012/2 "2022-01-12T15:12:54Z")
a) Maybe might be easier with a custom EventListener (to be tested, do not know performances…): - you can catch update events : UPDATE\_PROFILE ? - and use user.setSingleAttribute(…) b) Or user a virtual claim : [keycloak-extension-playground/SimpleOidcMapper.java at master · thomasdarimont/keycloak-extension-playground · GitHub](https://github.com/thomasdarimont/keycloak-extension-playground/blob/master/simple-oidc-mapper/src/main/java/com/github/thomasdarimont/keycloak/oidc/mapper/simple/SimpleOidcMapper.java) ---
**Author:** ![dwi](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@dwi](https://forum.keycloak.org/u/dwi)\ **Post date:** [January 12, 2022, 4:51pm UTC](https://forum.keycloak.org/t/how-to-map-two-ldap-attributes-to-one-user-attribute/13012/3 "2022-01-12T16:51:17Z")
Hi, I do not understand how an EventListener would access LDAP attributes on user logins nor how a virtual claim would help in this situation. ---
**Author:** ![semangard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/semangard/32/1922_2.png) [@semangard](https://forum.keycloak.org/u/semangard)\ **Post date:** [January 13, 2022, 6:35am UTC](https://forum.keycloak.org/t/how-to-map-two-ldap-attributes-to-one-user-attribute/13012/4 "2022-01-13T06:35:37Z")
Idea 1) Once LDAP attributes are imported into your realm as user attributes, any change to any of these user attributes should be caught by your listener (based on the event you decide to manage, for ex _EventType.UPDATE\_PROFILE_) which can then get access to the user (to whom the event is related to) in order to read _user.attr1_ and u_ser.attr_2 and write _user.attr1+user.attr2_ Ex on how to get access to the user related to an event and then create/update one attribute: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/6/63149137fc56902670cc24c625124fea2da052dc.png) ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/f/faab6d9eb6addc9c8925eb8a6aa64a77b2e97ff8.png) ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/2/27cbea807cfaac2165309d6e01fca6d7b1c1ffd5.png) BTW : performances of this approach have to be checked… and I am not sure the event UPDATE\_PROFILE is triggered when attributes are updated form LDAP… to be tested Idea 2) Once LDAP attributes are imported into your realm as user attributes you can use these users attributes to generate virtual claims, for ex a virtual claim which could be _user.attr1+user.attr2_ ---
**Author:** ![dwi](https://avatars.discourse-cdn.com/v4/letter/d/cdc98d/32.png) [@dwi](https://forum.keycloak.org/u/dwi)\ **Post date:** [January 13, 2022, 8:51am UTC](https://forum.keycloak.org/t/how-to-map-two-ldap-attributes-to-one-user-attribute/13012/5 "2022-01-13T08:51:17Z")
As far as I understand for Idea 1 and 2 I also need to configure attribute mappers to import the values from LDAP, correct? ---
**Author:** ![semangard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/semangard/32/1922_2.png) [@semangard](https://forum.keycloak.org/u/semangard)\ **Post date:** [January 13, 2022, 9:40am UTC](https://forum.keycloak.org/t/how-to-map-two-ldap-attributes-to-one-user-attribute/13012/6 "2022-01-13T09:40:28Z")
Yes correct If your LDAP is an AD then some mappers are automatically added : ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/4/46e18f4de157e6fa80d7e19b9a2eb7cc4afcf4a6.png) But you can also add some additional ones: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/9/9123fcce768e1f4a6f3b8b76e52f277371c2c055.png) ---
**Author:** ![jrobinss](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jrobinss/32/113_2.png) [@jrobinss](https://forum.keycloak.org/u/jrobinss)\ **Post date:** [January 18, 2022, 5:26pm UTC](https://forum.keycloak.org/t/how-to-map-two-ldap-attributes-to-one-user-attribute/13012/7 "2022-01-18T17:26:42Z")
Simple suggestion, not sure it fits the bill: just use a mapper. use type ScriptMapper, and put code like this: ```auto exports = user.getSomething() + user.getSomethingElse() ``` I don’t know the specifics, you’d have to work out the exact code of course. (above is a string concat) Beware of some known mapping issues, though - [[KEYCLOAK-19418] OIDC Identity Provider Claim to Role only looks at User Info - Red Hat Issue Tracker](https://issues.redhat.com/browse/KEYCLOAK-19418) - [[KEYCLOAK-17793] Attribute mapping not done at first broker login during idtoken/jwt exchange - Red Hat Issue Tracker](https://issues.redhat.com/browse/KEYCLOAK-17793) (maybe others, these are the ones that I’m aware of)