attribute resolver script

[Etienne Dysli-Metref]

On 09/11/16 15:44, Peter Schober wrote:
> * no issues wrt Java and scripting engine version (Rhino vs. Nashorn)
>   (or adding and updating scripting engines for other languagues,
>   e.g. JPython)

^ this! No more nasty surprises when you upgrade from IdP v2 to v3 or
Java 7 to 8. :)

I eliminated almost all scripted attribute definitions from our standard
attribute resolver configuration when we (SWITCH) updated our IdP guide
for v3. There is only one remaining:

<!-- If the commonName is not contained in your LDAP directory: compose
the value with JavaScript -->
<resolver:AttributeDefinition id="commonName" xsi:type="ad:Script">
    <resolver:Dependency ref="givenName" />
    <resolver:Dependency ref="surname" />

    <resolver:DisplayName xml:lang="en">Common Name</resolver:DisplayName>
    <resolver:DisplayName xml:lang="de">Name</resolver:DisplayName>
    <resolver:DisplayName xml:lang="fr">Nom</resolver:DisplayName>
    <resolver:DisplayName xml:lang="it">Nome</resolver:DisplayName>
    <resolver:DisplayDescription xml:lang="en">
        One or more names that should appear in white-pages-like
applications for this person.
    </resolver:DisplayDescription>
    <resolver:DisplayDescription
xml:lang="de">Name</resolver:DisplayDescription>
    <resolver:DisplayDescription
xml:lang="fr">Nom</resolver:DisplayDescription>
    <resolver:DisplayDescription
xml:lang="it">Nome</resolver:DisplayDescription>

    <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:cn" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.5.4.3" friendlyName="cn" />

    <ad:Script>
      <![CDATA[
        // This implementation composes the value of the attribute
commonName
        // from the values of the attributes givenName and surname. Only
        // the first value of each (possibly multi-valued) attribute is
used.
        // This corresponds to the relevant definitions of givenName and
surname
        // in the SWITCHaai Attribute Specification, where they are required
        // to be single-valued.

        if (givenName.getValues().size() > 0) {
          gn0 = givenName.getValues().get(0);
        }
        if (surname.getValues().size() > 0) {
          sn0 = surname.getValues().get(0);
        }

        if (gn0 && sn0) {
          commonName.addValue(gn0 + " " + sn0);
        } else if (gn0) {
          commonName.addValue(gn0);
        } else if (sn0) {
          commonName.addValue(sn0);
        }
      ]]>
    </ad:Script>
</resolver:AttributeDefinition>

Come to think of it, maybe the if-else dance could be done in a template...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20161125/2dc42db1/attachment.sig>