AttributeDefinition multivalued to single value attribute?

[Baron Fujimoto]

On Thu, Jun 07, 2018 at 03:14:42AM +0000, Lipscomb, Gary wrote:
>
><AttributeDefinition xsi:type="Mapped"
>       id=" hasFoo"
>       sourceAttributeID=" someAttr ">
>     <Dependency ref=" someAttr " />
>     <DisplayName xml:lang="en">Has Foo</DisplayName>
>
>     <ValueMap>
>       <ReturnValue>true</ReturnValue>
>                <SourceValue>foo</SourceValue>
>     </ValueMap>
>     <ValueMap>
>
>       <ReturnValue>false</ReturnValue>
>                  <SourceValue>bar</SourceValue>
>                 <SourceValue>baz</SourceValue>
>     </ValueMap>
>
>   </AttributeDefinition>

Hi Gary,

Thanks, but I think this is more or less equivalent to my original attempt below? Except I use a <DefaultValue> for the false terms rather than explicitly matching each value with a <ValueMap>. It's not really feasible for us to explicitly match each false value anyway, since the set of these values is not fixed in size and they may have arbitrary values (email addresses would be a good analogy).

This still has the problem I'm trying to solve of resulting in a multivalued "hasFoo" after deduping:

Log excerpt:

DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:434] - Attribute Resolver 'ShibbolethAttributeResolver': De-duping attribute definition hasFoo result
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:440] - Attribute Resolver 'ShibbolethAttributeResolver': Removing duplicate value StringAttributeValue{value=false} of attribute 'hasFoo' from resolution result
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:440] - Attribute Resolver 'ShibbolethAttributeResolver': Removing duplicate value StringAttributeValue{value=false} of attribute 'hasFoo' from resolution result
DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:446] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute 'hasFoo' has 2 values after post-processing

Excerpt from output of resolvertest:

  {
    "name": "hasFoo",
    "values": [
              "StringAttributeValue{value=false}",              "StringAttributeValue{value=true}"          ]
  }

But what I'd really like as a result is:

  {
    "name": "hasFoo",
    "values": [
              "StringAttributeValue{value=true}"          ]
  }


>-----Original Message-----
>From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Baron Fujimoto
>Sent: Thursday, 7 June 2018 12:56
>To: Shib Users <users at shibboleth.net>
>Subject: AttributeDefinition multivalued to single value attribute?
>
>Is there a recommended way to create an AttributeDefinition in the IdP's
>attribute-resolver.xml that will map a multivalued source attribute to a
>new single valued attribute?
>
>For example, if I have the a multivalued source attribute, "someAttr" with
>values as follows:
>
>someAttr: foo
>someAttr: bar
>someAttr: baz
>
>And I would like to define a new attribute, "hasFoo" which has value either
>"true" or "false" depending on the value of someAttr.
>
>If I do something like this
>
><resolver:AttributeDefinition xsi:type="ad:Mapped"
>        id="hasFoo-enabled"
>        sourceAttributeID="someAttr">
>
>    [...]
>
>    <!-- if someAttr is not "foo" return false -->
>    <ad:DefaultValue>false</ad:DefaultValue>
>
>    <!-- map "foo" to "true" -->
>    <ad:ValueMap>
>        <ad:ReturnValue>true</ad:ReturnValue>
>        <ad:SourceValue ignoreCase="true">foo</ad:SourceValue>
>    </ad:ValueMap>
></resolver:AttributeDefinition>
>
>I wind up with a multivalued set of hasFoo like
>
>hasFoo: true
>hasFoo: false
>hasFoo: false
>
>But the result I really want is just a single hasFoo with value "true" if
>there was a someAttr with value "foo", else hasFoo should be "false".
>
>The broader context for this is that I would like to return the single
>valued "hasFoo" in an AttributeFilterPolicy, and conditionally release
>other attributes based on the value of hasFoo. Maybe there's a better
>way to tackle this broader goal?
>
>-- 
>Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
>minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
>-- 
>For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>-- 
>For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum