Set attribute based on multiple sourceAttributeIds

[Klingenstein, Nate]

Juan,

Glad to help, and thank you for sharing your working code.

WRT: the domain getting separated, my hunch is the value is treated as scoped somewhere, which triggers the value to get cleaved up internally using the default @ delimiter, and it hasn't been flattened again by the point where you're looking at it.

I don't know enough about the resolver to tell you how or when that is most probable in your situation, but it'd be a worthwhile learning exercise anyhow, so I would look at the full pipeline from LDAP to filter.  You can also put some basic logging directly in your script very easily using Logback.

https://wiki.shibboleth.net/confluence/display/IDP30/ScopedAttributeDefinition

Hope this also helps,
Nate.

On Oct 5, 2016, at 1:47 PM, Juan Padilla <juan.padilla at nxp.com<mailto:juan.padilla at nxp.com>> wrote:

Thank you for the link … was easier than I thought, using the following:


<ad:Script><![CDATA[

        importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
        setEmail = new BasicAttribute("setEmail");
        setEmail.getValues().add(alt_email.getValues().get(0));
        if(setEmail.getValues().size<1)
        {
               setEmail.getValues().add(email.getValues().get(0));
        }

]]></ad:Script>



But seems that the email address is either being truncated or split after script execution (example: joe.blow instead of joe.blow at hubbabubba.com<mailto:joe.blow at hubbabubba.com>).

Logs show value from ldap: Found the following attribute: alt_email[joe.blow at hubbabubba.com<mailto:joe.blow at hubbabubba.com>]


I’m using Shib2.

Thanks.
-Juan

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Klingenstein, Nate
Sent: Wednesday, October 05, 2016 12:20 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Set attribute based on multiple sourceAttributeIds

Juan,

Yes, that's very possible, along with almost anything else you can imagine.

Personally, I'd do this with a Script attribute that implemented that very simple logic: specialEmail ~= "if !null A, use A, else, use B"

https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition

Then release that particular Script attribute to this SP with a dedicated filter.

There are many other ways, but this will give you the most flexibility by far.

Thanks,
Nate.

On Oct 5, 2016, at 10:16 AM, Juan Padilla <juan.padilla at nxp.com<mailto:juan.padilla at nxp.com>> wrote:

is it possible to configure attribute-resolver.xml to set and release an attribute based on the existence of multiple LDAP attributes? For example, I want to release an "email" attribute to the service provider: if LDAP has an attribute and value for "alt_email" then use that value ... otherwise use the value in LDAP attribute "email" (which will always exist).

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161005/756065ed/attachment-0001.html>