AttributeDefinition multivalued to single value attribute?

Baron Fujimoto baron at hawaii.edu
Fri Jun 8 17:22:57 EDT 2018 

To elaborate, if we can provide them an explicit true/false value for
hasFoo, they can use this to distinguish a possible reason why other
requested attributes may have conditionally not been released (as opposed
to say, those other attributes simply not existing themselves perhaps)

On Fri, Jun 08, 2018 at 11:17:55AM -1000, Baron Fujimoto wrote:
>I suppose because we wanted to return an explicit "true" or "false" to the
>SP. If we simply don't return the hasFoo attribute they'd have to infer
>hasFoo=false. I suppose if we must, we can go back to them and see if the
>design change is feasible for them.
>
>On Fri, Jun 08, 2018 at 03:29:20PM -0500, Michael A Grady wrote:
>>If you only want the one value, then why map the other values/have a DefaultValue? You want the other values "not mapped", so don't map them; having a DefaultValue does constitute a "mapping". Simply have nothing for the other values.
>>
>>> On Jun 8, 2018, at 3:25 PM, Baron Fujimoto <baron at hawaii.edu> wrote:
>>> 
>>> 
>>> On Thu, Jun 07, 2018 at 03:14:42AM +0000, Lipscomb, Gary wrote:
>>>> 
>>>> <AttributeDefinition xsi:type="Mapped"
>>>>      id=" hasFoo"
>>>>      sourceAttributeID=" someAttr ">
>>>>    <Dependency ref=" someAttr " />
>>>>    <DisplayName xml:lang="en">Has Foo</DisplayName>
>>>> 
>>>>    <ValueMap>
>>>>      <ReturnValue>true</ReturnValue>
>>>>               <SourceValue>foo</SourceValue>
>>>>    </ValueMap>
>>>>    <ValueMap>
>>>> 
>>>>      <ReturnValue>false</ReturnValue>
>>>>                 <SourceValue>bar</SourceValue>
>>>>                <SourceValue>baz</SourceValue>
>>>>    </ValueMap>
>>>> 
>>>>  </AttributeDefinition>
>>> 
>>> Hi Gary,
>>> 
>>> Thanks, but I think this is more or less equivalent to my original attempt below? Except I use a <DefaultValue> for the false terms rather than explicitly matching each value with a <ValueMap>. It's not really feasible for us to explicitly match each false value anyway, since the set of these values is not fixed in size and they may have arbitrary values (email addresses would be a good analogy).
>>> 
>>> This still has the problem I'm trying to solve of resulting in a multivalued "hasFoo" after deduping:
>>> 
>>> Log excerpt:
>>> 
>>> DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:434] - Attribute Resolver 'ShibbolethAttributeResolver': De-duping attribute definition hasFoo result
>>> DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:440] - Attribute Resolver 'ShibbolethAttributeResolver': Removing duplicate value StringAttributeValue{value=false} of attribute 'hasFoo' from resolution result
>>> DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:440] - Attribute Resolver 'ShibbolethAttributeResolver': Removing duplicate value StringAttributeValue{value=false} of attribute 'hasFoo' from resolution result
>>> DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:446] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute 'hasFoo' has 2 values after post-processing
>>> 
>>> Excerpt from output of resolvertest:
>>> 
>>>  {
>>>    "name": "hasFoo",
>>>    "values": [
>>>              "StringAttributeValue{value=false}",              "StringAttributeValue{value=true}"          ]
>>>  }
>>> 
>>> But what I'd really like as a result is:
>>> 
>>>  {
>>>    "name": "hasFoo",
>>>    "values": [
>>>              "StringAttributeValue{value=true}"          ]
>>>  }
>>> 
>>> 
>>>> -----Original Message-----
>>>> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Baron Fujimoto
>>>> Sent: Thursday, 7 June 2018 12:56
>>>> To: Shib Users <users at shibboleth.net>
>>>> Subject: AttributeDefinition multivalued to single value attribute?
>>>> 
>>>> Is there a recommended way to create an AttributeDefinition in the IdP's
>>>> attribute-resolver.xml that will map a multivalued source attribute to a
>>>> new single valued attribute?
>>>> 
>>>> For example, if I have the a multivalued source attribute, "someAttr" with
>>>> values as follows:
>>>> 
>>>> someAttr: foo
>>>> someAttr: bar
>>>> someAttr: baz
>>>> 
>>>> And I would like to define a new attribute, "hasFoo" which has value either
>>>> "true" or "false" depending on the value of someAttr.
>>>> 
>>>> If I do something like this
>>>> 
>>>> <resolver:AttributeDefinition xsi:type="ad:Mapped"
>>>>       id="hasFoo-enabled"
>>>>       sourceAttributeID="someAttr">
>>>> 
>>>>   [...]
>>>> 
>>>>   <!-- if someAttr is not "foo" return false -->
>>>>   <ad:DefaultValue>false</ad:DefaultValue>
>>>> 
>>>>   <!-- map "foo" to "true" -->
>>>>   <ad:ValueMap>
>>>>       <ad:ReturnValue>true</ad:ReturnValue>
>>>>       <ad:SourceValue ignoreCase="true">foo</ad:SourceValue>
>>>>   </ad:ValueMap>
>>>> </resolver:AttributeDefinition>
>>>> 
>>>> I wind up with a multivalued set of hasFoo like
>>>> 
>>>> hasFoo: true
>>>> hasFoo: false
>>>> hasFoo: false
>>>> 
>>>> But the result I really want is just a single hasFoo with value "true" if
>>>> there was a someAttr with value "foo", else hasFoo should be "false".
>>>> 
>>>> The broader context for this is that I would like to return the single
>>>> valued "hasFoo" in an AttributeFilterPolicy, and conditionally release
>>>> other attributes based on the value of hasFoo. Maybe there's a better
>>>> way to tackle this broader goal?
>>>> 
>>>> --
>>>> Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
>>>> minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
>>>> --
>>>> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
>>>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>>>> --
>>>> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
>>>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>>> 
>>> --
>>> Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
>>> minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
>>> --
>>> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
>>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>>> 
>>> ----------
>>> 
>>> This email has been scanned for spam and viruses by Proofpoint Essentials. Visit the following link to report this email as spam:
>>> https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1528489549-Mt59gIRTN77a&r_address=mgrady%40unicon.net&report=1
>>
>>--
>>Michael A. Grady
>>IAM Architect, Unicon, Inc.
>>
>>
>>
>
>
>
>>-- 
>>For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
>>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>
>-- 
>Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
>minutas cantorum, minutas balorum, minutas carboratum desendus pantorum

-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum

More information about the users mailing list