Attribute Resolver DefaultValue?

[Scott Gilbert]

On shibboleth IdP 3.4.6

I have a user with appGroup=jamf_package as an attribute value pair in our
LDAP. I have created a group in the SP application called jamf_package and
added that user to it.

I am having an issue where if I set up the sourcevalue with a group prefix
like below it doesnt work with the SP. But if I add
<ad:DefaultValue>jamf_package</ad:DefaultValue> to the attribute resolver
entry below it works and the user is logged in.

    <resolver:AttributeDefinition id="jamfgroup" xsi:type="ad:Mapped"
sourceAttributeID="appGroup">
         <resolver:Dependency ref="ldap_ucsb_edu"/>
         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="
http://schemas.xmlsoap.org/claims/Group" friendlyName="group"
encodeType="false" />
            <ad:ValueMap>
                <ad:ReturnValue>$1</ad:ReturnValue>
                <ad:SourceValue>jamf_(\w*)</ad:SourceValue>
            </ad:ValueMap>
    </resolver:AttributeDefinition>

I am not sure what is wrong because I use this same sourcevalue "prefix"
config for other SP's and it works ok.


Scott Gilbert
IAM System Admin
Cloud Collaboration Admin
Enterprise Technology Services
University of California Santa Barbara
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210514/ed7f8ebb/attachment.htm>