behavior of mapped attribute definition

[Peter Schober]

* Morgan, Andrew J <morgan at oregonstate.edu> [2022-03-18 20:15]:
> What value(s) are stored in entitlement_dx if the user has multiple
> matching sourceValues (group memberships)?  For example, these
> matching groups:
> 
>   ismemberof: cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
>                        cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
>                        cn=dx-admin,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
>                        cn=dx-masquerade,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu

Is that stored verbatim like above (a single 'ismemberof' attribute
with multiple values separated by whitespace) or actually more like this:

ismemberof: cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
ismemberof: cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
ismemberof: cn=dx-admin,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
ismemberof: cn=dx-masquerade,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu

If the latter then you should be fine. (Though note that your regex is
not anchored -- does not start with '^' nor end with '$' so may match
more than you'd expect.)

If the former you'd need a script to split the values on whitespace
and iterate over then: Assuming the single value of the 'ismemberof'
has all the groups in one string your current regex would match
'cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu'
as a /single/ entitlement value string.
If you added an anchor to the beginning of the regex (to make it start
with '^') the resulting value would be
'cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu'
which is less bad (now it's only a single group as a single value) but
still not what's desired as it misses the second group
(cn=dxMasquerade) that's intended to be matched.

-peter