<Mechanism Name="ldap">
<MechanismProperties
...
/>
<IdentitySearch
Match="([^\\=]+)\\([^=]+)"
Base="dc=${1},dc=corp,dc=com"
Scope="subtree"
Filter="(&(objectClass=user)(sAMAccountName=${1}))"/>
<IdentitySearch
Match="[^@=]+@([^\.=]+)\.([^\.=]+)\.([^\.=]+)"
Base="dc=${1},dc=${2},dc=${3}"
Scope="subtree"
Filter="(&(objectClass=user)(userPrincipalName=${0}))"/>
<IdentitySearch
Match="([^\\@=]+)"
Base="dc=div,dc=corp,dc=com"
Scope="subtree"
Filter="(&(objectClass=user)(sAMAccountName=${1}))"/>
</Mechanism>
Most sites have only one way of identifying users, so you normally need only a single identity search or identity map.