Do you allow the customer to specify attribute mappings for any needed information beyond a user identifier? (e.g., Reference eduPerson, ePPA/ePPN/ePE)

This question is asking whether your service allows customers to customize how user attributes are mapped from their identity provider (IdP) to your service during authentication. In federated identity systems (like SAML or OAuth/OIDC), when a user logs in, the identity provider sends certain attributes about the user to your service. At minimum, this includes a unique identifier, but often organizations need to send additional attributes like name, email, department, role, etc. 'Attribute mappings' refers to the ability to configure how these attributes from the customer's identity system map to user attributes in your system. For example, mapping 'mail' from their system to 'email' in yours. The reference to 'eduPerson' and related schemas is particularly relevant in higher education contexts. These are standardized attribute schemas used by educational institutions that define specific user attributes like eduPersonPrincipalName (ePPN), eduPersonAffiliation (ePA), etc. This question is asked in security assessments because: 1. It determines flexibility for integration with the customer's identity management systems 2. It affects how access control can be implemented based on user attributes 3. It impacts privacy and data minimization (sending only needed attributes) 4. It's important for compliance in certain sectors like education When answering, you should clearly state whether your system supports custom attribute mappings, which specific standards you support (if any), and how customers can configure these mappings.