the proxy defaults to searching the userPrincipalName attribute for a match. If username_attribute is set to an LDAP attribute other than userPrincipalName whose values contain the @ symbol (such as mail)