Scripted Modification to eduPersonAffiliation

[Les LaCroix]

Michael,

This sounds like a situation we had with a vendor, and we managed it
without scripting.  In our case, the vendor did not want to see any value
of ePSA other than "student at ..."; in your case, it sounds like your vendor
doesn't want to see anything but "member at ...".  Here is the stanza I used
in attribute-filter.xml.

  <AttributeFilterPolicy id="release_student_ePSA">

    <!-- I use an "OR" rule to make it easier for

         someone to add another vendor in the future. -->

    <PolicyRequirementRule xsi:type="OR">
      <Rule xsi:type="Requester" value="<vendor's entityID>" />
    </PolicyRequirementRule>

    <!-- Make sure we are permitting the value we want.  Not necessary
         if ePSA is already part of a bundle that applies to the SP.  -->

    <AttributeRule attributeID="eduPersonScopedAffiliation">
      <PermitValueRule xsi:type="ANY" />
    </AttributeRule>

    <!-- Now deny all non-student values. -->
    <AttributeRule attributeID="eduPersonScopedAffiliation">
      <DenyValueRule xsi:type="NOT">
        <Rule xsi:type="Value" value="student" ignoreCase="true" />
      </DenyValueRule>
    </AttributeRule>
  </AttributeFilterPolicy>


Good luck! -Les


------------------------------
Les LaCroix '79 | Strategic Technologist
Carleton College | 1 N. College St. | MS 3-ITS | Northfield, MN 55057
507.222.5455 | free/busy
<https://calendar.google.com/calendar/embed?src=llacroix%40carleton.edu&ctz=America/Chicago>

On Wed, Jan 3, 2018 at 12:05 PM, Michael Dahlberg <olgamirth at gmail.com>
wrote:

> I have a problem with the requested values for eduPersonAffiliation with
> two of the SPs that I work with: one wants the value 'member' in place of
> the values 'student', 'staff', 'faculty', and 'employee'; and one wants the
> actual values.
>
> I've read https://www.internet2.edu/media/medialibrary/2013/09/04/
> internet2-mace-dir-eduperson-201203.html#eduPersonAffiliation and it
> looks like ePA is a multi-valued attribute so it should be permissible for
> the ePA to have the value 'member' and 'student'.  I was thinking that
> could be done with a scripted attribute.  With that in mind, I have three
> questions:
>
> (1) I've looked for some documentation on the scripting engine within the
> IdP and there does not look like there is much.  Other than that found in
> https://wiki.shibboleth.net/confluence/display/IDP30/
> ScriptedAttributeDefinition, would you be able to point me in the
> direction of some examples/descriptions of the functions?
>
> (2) From the examples in the default attribute-resolver.xml file, it looks
> like the add("") function overwrites the existing values.  Does the
> addValues("") function append a value to the existing value?
>
> (3) If ePA is multi-valued, what would the resulting attributes be for
> eduPersonScopedAffiliation:  (student,member at example.edu) or (
> student at example.edu,member at example.edu)?
>
> Thanks for the assistance.
>
> Mike
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180103/dbc3d272/attachment-0001.html>