Most efficient way to include other attributes verbatim in scripted attributes

Wessel, Keith kwessel at
Thu Nov 21 11:06:48 EST 2019

Thanks, Scott. Yes, I know I could use the metrics to time things, but I was hoping for some insight into the code behind a mapped attribute definition. I guess I could go snoop in the code, myself. Just wondered if that code was more efficient than just a for loop iterating over each value and doing a regex compare.

I didn't know about the addAll method. That worked fine and, I'm sure, is more efficient than my for loop to add the values one at a time.


-----Original Message-----
From: users <users-bounces at> On Behalf Of Cantor, Scott
Sent: Thursday, November 21, 2019 9:12 AM
To: Shib Users <users at>
Subject: Re: Most efficient way to include other attributes verbatim in scripted attributes

On 11/21/19, 9:51 AM, "users on behalf of Wessel, Keith" <users-bounces at on behalf of kwessel at> wrote:

> I realize I could just iterate over the user's raw group memberships 
> attribute instead and skip the mapped attribute definition, doing if 
> (group.match(/regex/) for each value. So, first question, is the 
> mapped attribute definition more efficient than iterating over the group memberships and matching each one against a regex in my script? Or is it essentially the same code?

If you really want to know things like that, the metrics support was built to let you install timers around individual connectors to measure the time. I don't think anything else is going to be anything but speculation.

> And second question: if the mapped attribute definition is more 
> efficient, is there a more efficient way in my script to take all of 
> the values of entitlementGroups and add them to eduPersonEntitlement? A way, that is, to say here's a multi-valued attribute; add all of its values to the list of values output by this script?

This is probably going to turn out to be "because I'm using Rhino instead of the garbage pile Nashorn" but my entitlement script has:


"entitlement" here is an attribute from an LDAP connector, so this is the part that echoes all of the directory-based values in my script that adds all the other stuff.

-- Scott

For Consortium Member technical support, see
To unsubscribe from this list send an email to users-unsubscribe at

More information about the users mailing list