Filter templates and multi-valued dependency attributes

[Cantor, Scott]

On 8/30/17, 9:21 AM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> Thanks, Scott. I assumed that was velocity code inside that template, but I wasn't positive. I'm used to just seeing a single LDAP
> query in there, at the most using something like the get(0) reference.

It's always one query/one filter, I'm just saying what's in the template itself is up to you. It is troublesome doing complex logic in it because of whitespace and such. I think that's where it gets tricky to embed Velocity logic without corrupting the filter string, but I haven't played with it that much.

> So, I guess my question should be how exactly does the filter template work? Does it output a string that gets passed in as the
> filter to the LDAP query?

Yes, literally, that's it.

> If I were to, say, make a for loop to iterate over the values of the memberOf attribute, would the contents of that for loop just be
> another component of the query or'd on to what I already hve? Or would the output be taken as a bunch of separate queries,
> one from each iteration of the for loop?

No, you can't loop to generate multiple filters, I'm saying if you stick in a loop macro in the string, the end result could be a filter with multiple values inside it as part of the LDAP expression.

In SQL, this would be, e.g. an "in" clause, like "select foo from bar where baz in (val1, val2, val3)"

The problem is commas. I think we actually have a StringSupport helper method in our libraries to generate comma delimited lists like this.

-- Scott