Code Review: Mapping Directory Groups to eduPersonEntitlement

[Cantor, Scott]

On 4/10/17, 9:26 PM, "users on behalf of Brian Moon" <users-bounces at shibboleth.net on behalf of bmoon at scu.edu> wrote:

> Interesting.  I'm sure I'll have more questions as I try to figure out how the values in memberOf can be used to lookup values.  I'm
> guessing that this would be done by defining a RelationalDatabaseConnector.  If so, would I be using a QueryTemplate in the
> connector, a TemplateAttributeDefinition in the resolver, or something else to do the lookup? 

I can't speak to your situation. All, any, none, it depends what the goal is and how the mapping works. If I had to map a set of group names in LDAP to entitlements, I would start out by dumping the idea of "local" group names. I think all group names should be URIs to start with, and then there is no mapping, the work is done.

If the mapping is mechanical, then certainly a Template attribute works well and is reasonably efficient. I don't use them for groups, but I turn my course enrollment data into entitlements mechanically that way.

Failing that, if I had a table of mappings in a database, I'd maybe feed the LDAP result's attribute into a JDBC query and format the SQL statement template by plugging in the set of values of the dependent attribute as a SQL "in" clause. It would depend on the scale, it's not going to work for a 100 groups, but for 10 it works fine.

Any mechanism that had to do the mappings one by one wouldn't handle 100 or 1000 particularly well. So that's where I think the problem really has to be re-thought, perhaps by just putting the entitlements into the directory or pulling the group data in and putting it in a database so a join in a basic query for the user's groups would handle the name translation.

>  My google-foo seems to be failing me at the moment since I'm not able to find any examples of this; do you know of
> any examples you can point me to?

I don't have anything that's not in the wiki and examples take enormous amounts of time to build and are extremely expensive to maintain (which is why nearly everything you find that's not in our documentation is out of date and even much of what is).

My advice is to learn what the connectors and definitions do, and if you don't understand what one does, just ask. Examples can only get you so far, and we have examples by now of most of the individual connectors to show how they're configured. Scripts are the hardest by definition, they're just too variable.
 
-- Scott