use "sdn" for scope display name
LDAP attribute mapping