Actually all properties mapped to LDAP must be available as java properties on target type. It would be great that picketlink LDAPIdentityStore could also handle situation when LDAP mapped property is not available as Java property on target type, but just as attribute. For example:

User john = new User("john");
john.setAttribute("foo", "fooValue");

and particular mapping:

 .mapping(User.class)                            
  .objectClasses(userObjectClasses)
  ...
 .attribute("firstName", "cn")
 .attribute("foo", "givenName")

In this case target type "User" has Java property "firstName" so it's mapped normally through this via getFirstName/setFirstName as it's now. In case of "foo" property, which doesn't exist on User, it will be mapped through getAttribute("foo")/setAttribute("foo", VAL)