behavior of mapped attribute definition

[Morgan, Andrew J]

Hi Peter,

It's a multi-valued LDAP attribute.  Using the AACLI as Keith suggested (duh!) made it easy to verify that the mapped attribute definition was doing the right thing.

Thanks,
Andy

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober via users <users at shibboleth.net>
Sent: Tuesday, March 22, 2022 2:24 AM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: behavior of mapped attribute definition

[This email originated from outside of OSU. Use caution with links and attachments.]

* Morgan, Andrew J <morgan at oregonstate.edu> [2022-03-18 20:15]:
> What value(s) are stored in entitlement_dx if the user has multiple
> matching sourceValues (group memberships)?  For example, these
> matching groups:
>
>   ismemberof: cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
>                        cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
>                        cn=dx-admin,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
>                        cn=dx-masquerade,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu

Is that stored verbatim like above (a single 'ismemberof' attribute
with multiple values separated by whitespace) or actually more like this:

ismemberof: cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
ismemberof: cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
ismemberof: cn=dx-admin,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu
ismemberof: cn=dx-masquerade,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu

If the latter then you should be fine. (Though note that your regex is
not anchored -- does not start with '^' nor end with '$' so may match
more than you'd expect.)

If the former you'd need a script to split the values on whitespace
and iterate over then: Assuming the single value of the 'ismemberof'
has all the groups in one string your current regex would match
'cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu'
as a /single/ entitlement value string.
If you added an anchor to the beginning of the regex (to make it start
with '^') the resulting value would be
'cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu'
which is less bad (now it's only a single group as a single value) but
still not what's desired as it misses the second group
(cn=dxMasquerade) that's intended to be matched.

-peter
--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=04%7C01%7Cmorgan%40oregonstate.edu%7C69933dbc3a364f23dd7908da0be5c81b%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637835378781107108%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=d79%2FF9djYoj8HGAK%2B1kxW2H6w4xSGahzsY7jbkf5E8M%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220322/79db5f94/attachment.htm>