attribute definition, template or other means?

[Baron Fujimoto]

On Tue, Oct 20, 2020 at 12:18:42PM +0000, Cantor, Scott wrote:
>On 10/19/20, 10:47 PM, "users on behalf of Baron Fujimoto" <users-bounces at shibboleth.net on behalf of baron at hawaii.edu> wrote:
>
>>    And advises, "If you have result sets (e.g. from LDAP) that don't satisfy this rule, just make sure to enumerate the
>> attributes you need", but I'm not sure how that translates into what I'd need to do to the attribute definition above.
>
>It doesn’t, because that warning has nothing to do with that problem. You can't have different cardinalities.
>
>>    Alternatively, I'm also open to a different/better approach rather than using Template. Any tips and suggestions would
>> be welcomed.
>
>A script is the only way.

Mahalo for pointing me in the right direction. I finally wound up with the following, which seems to work for our purposes (not claiming this is the best way to do this[*]).

=====
     <resolver:AttributeDefinition xsi:type="ad:Script"
             id="eduPersonSubScopedAffiliation" >

         <resolver:Dependency ref="eduPersonAffiliation" />
         <resolver:Dependency ref="exampleOrg" />

         <resolver:AttributeEncoder xsi:type="enc:SAML2String"
                 name="eduPersonSubScopedAffiliation" />

         <ad:Script>
             <![CDATA[
                 for (affIndex = 0; affIndex < eduPersonAffiliation.getValues().size(); affIndex++) {
                     // only one value for eduPersonAffiliation is expected
                     for (orgIndex = 0; orgIndex < exampleOrg.getValues().size(); orgIndex++) {
                         eduPersonSubScopedAffiliation.addValue(eduPersonAffiliation.getValues().get(affIndex) + "@" + exampleOrg.getValues().get(orgIndex)  + ".%{idp.scope}");
                     } // exampleOrg
                 } // eduPersonAffiliation
              ]]>
         </ad:Script>

     </resolver:AttributeDefinition>
=====

[*] Our eduPersonAffiliation IdP attribute definition maps a bunch of particular affiliations to "member", or nothing at all, so we only expect this attribute to be populated with a single vlaue. YMMV...

-- 
UH Information Technology Services : Identity & Access Mgmt, Middleware
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum