Multiple Dependency/sourceAttributeID

[Bellina, Brendan]

I may be wrong, but it seems like Matthew's earlier suggestion that a script be used is worth considering.  It looks to me like the built-in functions are really designed for simple OR conditions rather than the kind of AND conditions you want to use.  I would consider using a simple script for each of the dependencies that you need, the product of which would be a new entitlement value for each dependency.  Then use the built-in ValueMap functionality to OR those new entitlement values and create your new finalEntitlement.  Optionally, if these dependencies are pretty fixed you could write one big script that encompasses all of the logic needed for your finalEntitlement.

There are script examples on the page <https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples>

Regards,

Brendan Bellina
Identity Mgmt. Architect, IT Services, UCLA



From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Joel Levin <joel.aaron.levin at gmail.com<mailto:joel.aaron.levin at gmail.com>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Friday, November 13, 2015 at 10:59 AM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Multiple Dependency/sourceAttributeID

Hi:

I am trying to build a new entitlement - that is based on presence of any 4 other entitlements - i.e. finalEntitlement = entitlement1 OR entitlement2 OR entitlement3 OR entritlement4.

Here is what I have so far - it obviously does not work.

Each of the 4 entitlements have a unique Attribute Definition and corresponding unique sourceAttributeId (I know - the data is messy) - the individual entitlements have complex SQL queries behind them.

Any ideas on how to proceed? If not possible - that is good to know as well.

There is a separate AttributeDefinition that all the separate eduPersonEntitlement Calculations feed up.

          <resolver:AttributeDefinition id="finalEntitlement">

                    <resolver:Dependency ref="eduPersonEntitlement Calculation 1" />
                    <resolver:Dependency ref="eduPersonEntitlement Calculation 2" />
                    <resolver:Dependency ref="eduPersonEntitlement Calculation 3" />
                    <resolver:Dependency ref="eduPersonEntitlement Calculation 4" />

                    <DefaultValue>https://www.example.com/foobar</DefaultValue>

                    <ValueMap>
                         <ReturnValue>https://www.example.com/superstar</ReturnValue>
                         <SourceValue>eduPersonEntitlement Calculation 1</SourceValue>
                         <SourceValue>eduPersonEntitlement Calculation 2</SourceValue>
                         <SourceValue>eduPersonEntitlement Calculation 3</SourceValue>
                         <SourceValue>eduPersonEntitlement Calculation 4</SourceValue>
                     </ValueMap>


                      <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                                name="urn:mace:dir:attribute-def:final"
                                friendlyName="final" />

          </resolver:AttributeDefinition>

On Fri, Nov 13, 2015 at 10:43 AM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
On 11/13/15, 1:14 PM, "users on behalf of Joel Levin" <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of joel.aaron.levin at gmail.com<mailto:joel.aaron.levin at gmail.com>> wrote:



>Is it possible for 'AttributeDefinition' to have multiple 'Dependency' & 'sourceAttributeID'?

There is no single semantic for source attribute (and it's often broken for many). You're going to have to ask about a specific attribute definition type.

Any plugin can have multiple dependencies.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151113/ae3188b0/attachment.html>