attribute resolver script

[Andrew Morgan]

On Tue, 22 Nov 2016, Tom Poage wrote:

>
>> On Nov 22, 2016, at 11:16 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>> My issue with it seems to be that I'm not sure under what conditions it 
>> seems to produce output that makes sense. It doesn't seem to do what I 
>> would think it would, so I'm not clear on whether that's a failure in 
>> design or if we're just missing a plugin that does what I would expect.
>>
>> To me, given each value of input, I would think you'd get *a* mapped or 
>> default value out (or nothing if there's no match and no pass through). 
>> If that's not what it does, then I don't know why or why that's useful.
>
> Back ported to an old 2.4 instance I have lying about. Same behavior. I 
> never did properly understand how Mapped worked.

I'm confused by all this confusion!  :)

I'm using the Mapped attribute in several places, primarily to take group 
membership from ismemberof and turn it into an entitlement value.

Here is an example for Comcast:

   <resolver:AttributeDefinition xsi:type="ad:Mapped" id="comcast_xoc" sourceAttributeID="ismemberof">
       <resolver:Dependency ref="ONIDLDAP" />
       <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" friendlyName="eduPersonEntitlement" />
       <ad:ValueMap>
           <ad:ReturnValue>http://www.xfinityoncampus.com/xoc-access</ad:ReturnValue>
           <ad:SourceValue ignoreCase="true">cn=xfinityoncampus,ou=uhds,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu</ad:SourceValue>
       </ad:ValueMap>
   </resolver:AttributeDefinition>


Here is a weird example to make sure we always release a firstname to 
Webex.  Givenname is not a required attribute in LDAP, so sometimes we 
don't populate it, but Webex requires a value.  We return "." when 
givenname is empty.

   <resolver:AttributeDefinition xsi:type="ad:Mapped" id="webex_firstname" sourceAttributeID="givenName">
       <resolver:Dependency ref="ONIDLDAP" />
       <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="firstname" />
       <ad:DefaultValue>.</ad:DefaultValue>
       <ad:ValueMap>
           <ad:ReturnValue>$1</ad:ReturnValue>
           <ad:SourceValue>(.+)</ad:SourceValue>
       </ad:ValueMap>
   </resolver:AttributeDefinition>


 	Andy