APM LDAP Auth Using Email Address

I just finished doing something similar. Essentially I modified the policy to allow

domain\username

,

username

(using default domain), and

email

. Since you're asking about just email, I'll explain what I did there. (Note: we use AD instead of LDAP, but this is how I think it ought to work for you)

After the

Login Page

action, I would use the

LDAP Auth

action to search for the user. I would set the

SearchFilter

to

(mail=%{session.logon.last.logonname})

and the root LDAP DN in the

SearchDN

.

From there, use an

LDAP Query

action with the same

SearchFilter

and

SearchDN

and add whatever attributes you'll need (i.e.

samaccountname

).

From there, you can add an

SSO Credential Mapping

object using

session.ldap.last.attr.sAMAccountName

for the

SSO Token Username

property (may show up in the drop down there).

Hopefully that will help.