Using the transform AttributeResolver

[Cantor, Scott]

On 1/21/14, 3:08 PM, "Scott Hall" <shall05 at MIT.EDU> wrote:
>
>I have an attribute named "memberOf" that contains group data from an
>ldap store in this form:
>
>CN=exchange.users,OU=groups,OU=Admin,DC=exchange,DC=mit,DC=edu;CN=shuttlet
>rack-request,OU=mail,OU=lists,OU=Moira,DC=exchange,DC=mit,DC=edu;CN=pfaids
>-rt,OU=mail,OU=lists,OU=Moira,DC=exchange,DC=mit,DC=edu;CN=ppl-acl,OU=grou
>p,OU=lists,OU=Moira,DC=exchange,DC=mit,DC=edu;CN=sap-lpcaccess-top,OU=mail
>,OU=lists,OU=Moira,DC=exchange,DC=mit,DC=edu;
>.... (lot's more data)

I assume you don't literally mean that's a single value coming from the
IdP, as that's not appropriate to bury multiple values like that.

>I need to strip out the OU/DC entries leaving an attribute with data in
>this form:
>
>CN=exchange.users,CN=shuttletrack-request,CN=pfaids-rt,CN=ppl-acl,CN=sap-l
>pcaccess-top ...

A multi-valued attribute should be, well, multiple values. They will be so
until the SP serializes a header and separates the values with a
semicolon. So nothing should produce a result that looks like that.

>I have a transform rule that looks like this at the moment:
>
><AttributeResolver type="Transform" source="memberOf">
>	<Regex match="(CN=.*?,)">$1</Regex>
></AttributeResolver>

That definitely isn't right (just try a Java regex demo [1] and it won't
match), but complex regular expressions are not my area. I will note for
emphasis that this is not Perl or anything close to it in terms of what
will work. Greedy qualifiers and such don't, for example.

>Using the $1 placeholder I get unchanged data in the attribute - (on a
>match it passes the data through unchanged?)

No, on a non-match. And your example definitely is not a match.

>Using the $2 placeholder I get the all BUT the matches

There's no second group there to match, so I don't know what $2 would mean.

>Any clues as to how the rule should be structured - or have I missed
>something?

It's beyond my experience and is surprisingly difficult for me to come up
with something using Java, so that leaves me more or less unable to
suggest anything.

-- Scott

[1] http://www.regexplanet.com/advanced/java/index.html