Using the transform AttributeResolver

[Scott Hall]

Hi Scott,

On 1/21/14 3:35 PM, Cantor, Scott wrote:
> On 1/21/14, 3:08 PM, "Scott Hall" <shall05 at MIT.EDU> wrote:>
> I assume you don't literally mean that's a single value coming from the
> IdP, as that's not appropriate to bury multiple values like that.


Yes - that's my ignorance showing
That was data from the header.

> A multi-valued attribute should be, well, multiple values. They will be so
> until the SP serializes a header and separates the values with a
> semicolon. So nothing should produce a result that looks like that.

Again my ignorance showing - I assume the header would end up in a form:

CN=group0;CN=group1;CN=groupN;


>> I have a transform rule that looks like this at the moment:
>>
>> <AttributeResolver type="Transform" source="memberOf">
>> 	<Regex match="(CN=.*?,)">$1</Regex>
>> </AttributeResolver>
>
> That definitely isn't right (just try a Java regex demo [1] and it won't
> match), but complex regular expressions are not my area. I will note for
> emphasis that this is not Perl or anything close to it in terms of what
> will work. Greedy qualifiers and such don't, for example.
>
>> Using the $1 placeholder I get unchanged data in the attribute - (on a
>> match it passes the data through unchanged?)
>
> No, on a non-match. And your example definitely is not a match.
>
>> Using the $2 placeholder I get the all BUT the matches
>
> There's no second group there to match, so I don't know what $2 would mean.

Thanks I'll go read up some and keep trying... It is worth noting that I do get a result using the $2 placeholder even if it's an unexpected 
one... It seems to give me the inverse of my intended match - even if my example rule is bonkers!

Thanks again!

- Scott