behavior of mapped attribute definition

[Wessel, Keith]

Andy,

The attribute definition should iterate over each  alue of the group memberships and build a separate value of the multi-valued output attribute for each match. You shouldn't get a confusing single-valued attribute.

You can, of course, confirm this using aacli.

Keith


From: users <users-bounces at shibboleth.net> On Behalf Of Morgan, Andrew J
Sent: Friday, March 18, 2022 2:15 PM
To: users at shibboleth.net
Subject: behavior of mapped attribute definition

Given the following attribute definition:

    <AttributeDefinition xsi:type="Mapped" id="entitlement_dx">
        <InputDataConnector ref="ONIDLDAP" attributeNames="ismemberof" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" friendlyName="eduPersonEntitlement" />
        <ValueMap>
            <ReturnValue>urn:mace:oregonstate.edu:entitlement:dx:$1</ReturnValue>
            <SourceValue caseSensitive="false">cn=([^,]+),ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu</SourceValue>
            <SourceValue caseSensitive="false">cn=([^,]+),ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu</SourceValue>
        </ValueMap>
    </AttributeDefinition>

What value(s) are stored in entitlement_dx if the user has multiple matching sourceValues (group memberships)?  For example, these matching groups:

  ismemberof: cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
                       cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
                       cn=dx-admin,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
                       cn=dx-masquerade,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu

My desired output is a list of entitlement values built from the group names, not a single value, of course.  Do I need a separate ValueMap for each SourceValue regex?

Thanks,
Andy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220318/1691b44d/attachment.htm>