Code Review: Mapping Directory Groups to eduPersonEntitlement

[Brian Moon]

Hello all,

I just wrote a script to map directory groups to eduPersonEntitlement
strings.  Everything seems to be working fine with it, although I would
appreciate a code review to make sure that I haven't done anything stupid
with it, or to see if there are areas that could be better optimized.  To
create this, I was relying on documentation available at
https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition
and
https://spaces.internet2.edu/display/Grouper/Exposing+Groups+Through+Shibboleth
(which seemed to be outdated).  We are currently running IdP v3.3.1.

Below is the entry in attribute-resolver.xml:
    <AttributeDefinition xsi:type="ScriptedAttribute"
id="eduPersonEntitlement">
        <Dependency ref="MyLDAP" />
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:eduPersonEntitlement" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" friendlyName="eduPersonEntitlement"
encodeType="false" />
        <Script><![CDATA[
          logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.eppnbuilder");
          attributeStringType =
Java.type("net.shibboleth.idp.attribute.StringAttributeValue");

          // Load entitlementMap
          logger.debug("Loading entitlementMap:
%{idp.home}/conf/entitlement-map.js");
          load("%{idp.home}/conf/entitlement-map.js");

          // If the user has group membership
          if(typeof memberOf != "undefined" && memberOf != null ){
            // Then go through each group membership and add the
appropriate entitlement
            // The IdP will remove duplicate values so we don't need to
worry about that here
            for(i = 0; memberOf != null && i < memberOf.getValues().size();
++i){
              // Group names here contain the CN and the full path in the
directory to the group.
              // For simplicity, only the group name is extracted from this
string.
              var groupName =
memberOf.getValues().get(i).split(",",1)[0].substring(3);

              logger.debug("Looking for entitlements matching '" +
groupName + "'");
              var entitlements = entitlementMap[groupName];
              if(entitlements != null && entitlements.length > 0) {
                for(j = 0; j < entitlements.length; ++j) {
                  logger.debug("Adding entitlement of " + entitlements[j]);
                  eduPersonEntitlement.addValue(new
attributeStringType(entitlements[j]));
                }
              }
            }
          }
        ]]></Script>
    </AttributeDefinition>

Below is the content of the %{idp.home}/conf/entitlement-map.js file:
/**
 * This file containts the mappings of group memberships to
 * eduPeronEntitlement.  Mappings should be in the following format:
 *   "Group Name": [
 *     "urn:mace:yourNamespace:entitlement:xxxx",
 *     "urn:mace:yourNamespace:entitlement:yyyy"
 *   ],
 *
 * This data structure was chosen to allow for fast lookups of directory
groups
 * to see if there are any associated entitlements.  The entitlements listed
 * for each group are in the form of an array so that it will be able to
support
 * multiple entitlements for a single group.
 */
var entitlementMap = {

  // Application1 Entitlement
  "Entitlement-Application1": [
    "https://entitlement/URL/for/Application1",
    "urn:mace:yourNamespace:entitlement:application1"
  ],
};

Thanks!

Brian Moon
Senior System Administrator
Enterprise Systems
Santa Clara University
Office: 408.554.4830
bmoon at scu.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170410/da67377e/attachment-0001.html>