behavior of mapped attribute definition

[Morgan, Andrew J]

Given the following attribute definition:

    <AttributeDefinition xsi:type="Mapped" id="entitlement_dx">
        <InputDataConnector ref="ONIDLDAP" attributeNames="ismemberof" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" friendlyName="eduPersonEntitlement" />
        <ValueMap>
            <ReturnValue>urn:mace:oregonstate.edu:entitlement:dx:$1</ReturnValue>
            <SourceValue caseSensitive="false">cn=([^,]+),ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu</SourceValue>
            <SourceValue caseSensitive="false">cn=([^,]+),ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu</SourceValue>
        </ValueMap>
    </AttributeDefinition>

What value(s) are stored in entitlement_dx if the user has multiple matching sourceValues (group memberships)?  For example, these matching groups:

  ismemberof: cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
                       cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
                       cn=dx-admin,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
                       cn=dx-masquerade,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu

My desired output is a list of entitlement values built from the group names, not a single value, of course.  Do I need a separate ValueMap for each SourceValue regex?

Thanks,
Andy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220318/53368969/attachment.htm>