You cannot map a directory user to a permanent user with zone privileges. You must use roles instead. External users and application proxy users cannot be zone users, but they can be zone guests. After the zone creator creates a zone guest, any zone user can grant access privileges on zone objects to the guests by granting them to external roles or proxy user roles.
For more information about roles and proxy users, see Setting Up Trusted User Applications and Proxy Users (Recommended) and Working with Roles for Proxy Users.