Most efficient way to include other attributes verbatim in scripted attributes

[Wessel, Keith]

All,

We're mapping several LDAP groups to entitlements, many with regex so we can include part of the group name in the entitlement value for sets of groups matching a pattern. I'd like to do this efficiently since users can have a lot of group memberships, and I suspect iterating over all of them might get expensive.

Currently, I'm using a mapped attribute definition to map the groups to entitlement values in an internal attribute called entitlementGroups. I then use entitlementGroups in my eduPersonEntitlement script. The script is using other attributes besides the group memberships to apply other entitlement values. So, I can't just replace the whole eduPersonEntitlement definition with a mapped attribute. But for the entitlementGroups attribute, the eduPersonEntitlement script just iterates over it with a for-loop to do an eduPersonEntitlement.addValue for each of its values.

I realize I could just iterate over the user's raw group memberships attribute instead and skip the mapped attribute definition, doing if (group.match(/regex/) for each value. So, first question, is the mapped attribute definition more efficient than iterating over the group memberships and matching each one against a regex in my script? Or is it essentially the same code?

And second question: if the mapped attribute definition is more efficient, is there a more efficient way in my script to take all of the values of entitlementGroups and add them to eduPersonEntitlement? A way, that is, to say here's a multi-valued attribute; add all of its values to the list of values output by this script?

Thanks,
Keith