Constructing Pattern from ProfileRequestContext

[Orlandis Brown]

I am tasked with configuring the Impersonation intercept for Shibboleth 5,
but there is one particular requirement that doesn't seem to be supported
by any interface. Within the GeneralImpersonationPolicy, we would like to
implement the following:

Any user who has an eduPersonEntitlement value of the form
"ENTITYID;;Impersonate;;USER", where ENTITYID is the requester
RelyingPartyId, should be shown the impersonation interface.

We would like to partially match values prefixed with the RelyingPartyId
found in ProfileRequestContext. I assume the correct approach would be to
use the shibboleth.Conditions.RegexAttribute bean to match everything after
ENTITYID. But how can I construct a pattern prefixed by RelyingPartyId, or
some other value found in the ProfileRequestContext, to supply to
RegexAttribute? For example:

<entry key="GeneralImpersonationPolicy">
        <bean parent="shibboleth.PredicateAccessControl">
            <constructor-arg>
                <bean parent="shibboleth.Conditions.RegexAttribute">
                    <property name="attributeId"
value="eduPersonEntitlement" />
                    <property name="pattern"

value="#{ProfileRequestContext...getRelyingPartyId()};;Impersonate;;.*" />
                    </property>
                </bean>
            ...

Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240305/89a22215/attachment.htm>