<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 15px; font-family: 'Times New Roman', sans-serif;">
<div>
<div>I may be wrong, but it seems like Matthew's earlier suggestion that a script be used is worth considering. It looks to me like the built-in functions are really designed for simple OR conditions rather than the kind of AND conditions you want to use.
I would consider using a simple script for each of the dependencies that you need, the product of which would be a new entitlement value for each dependency. Then use the built-in ValueMap functionality to OR those new entitlement values and create your
new finalEntitlement. Optionally, if these dependencies are pretty fixed you could write one big script that encompasses all of the logic needed for your finalEntitlement.</div>
<div><br>
</div>
<div>There are script examples on the page <<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples">https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples</a>></div>
<div>
<div><br>
</div>
<div>Regards,</div>
<div><br>
</div>
<div>Brendan Bellina</div>
<div>Identity Mgmt. Architect, IT Services, UCLA</div>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of Joel Levin <<a href="mailto:joel.aaron.levin@gmail.com">joel.aaron.levin@gmail.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Friday, November 13, 2015 at 10:59 AM<br>
<span style="font-weight:bold">To: </span>Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: Multiple Dependency/sourceAttributeID<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div>Hi:<br>
<br>
</div>
I am trying to build a new entitlement - that is based on presence of any 4 other entitlements - i.e. finalEntitlement = entitlement1 OR entitlement2 OR entitlement3 OR entritlement4.<br>
<div>
<div><br>
</div>
<div>Here is what I have so far - it obviously does not work.<br>
<br>
</div>
<div>Each of the 4 entitlements have a unique Attribute Definition and corresponding unique sourceAttributeId (I know - the data is messy) - the individual entitlements have complex SQL queries behind them.<br>
<br>
</div>
<div>Any ideas on how to proceed? If not possible - that is good to know as well.<br>
<br>
</div>
<div>There is a separate AttributeDefinition that all the separate eduPersonEntitlement Calculations feed up.<br>
</div>
<div> <br>
<resolver:AttributeDefinition id="finalEntitlement"><br>
<br>
<resolver:Dependency ref="eduPersonEntitlement Calculation 1" /><br>
<resolver:Dependency ref="eduPersonEntitlement Calculation 2" />
<br>
<resolver:Dependency ref="eduPersonEntitlement Calculation 3" /><br>
<resolver:Dependency ref="eduPersonEntitlement Calculation 4" />
<br>
<br>
<DefaultValue><a href="https://www.example.com/foobar">https://www.example.com/foobar</a></DefaultValue><br>
<br>
<ValueMap><br>
<ReturnValue><a href="https://www.example.com/superstar">https://www.example.com/superstar</a></ReturnValue><br>
<SourceValue>eduPersonEntitlement Calculation 1</SourceValue><br>
<SourceValue>eduPersonEntitlement Calculation 2</SourceValue><br>
<SourceValue>eduPersonEntitlement Calculation 3</SourceValue><br>
<SourceValue>eduPersonEntitlement Calculation 4</SourceValue><br>
</ValueMap><br>
<br>
<br>
<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>
name="urn:mace:dir:attribute-def:final" <br>
friendlyName="final" /><br>
<br>
</resolver:AttributeDefinition><br>
</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Nov 13, 2015 at 10:43 AM, Cantor, Scott <span dir="ltr">
<<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class="">On 11/13/15, 1:14 PM, "users on behalf of Joel Levin" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:joel.aaron.levin@gmail.com">joel.aaron.levin@gmail.com</a>> wrote:<br>
<br>
<br>
<br>
>Is it possible for 'AttributeDefinition' to have multiple 'Dependency' & 'sourceAttributeID'?<br>
<br>
</span>There is no single semantic for source attribute (and it's often broken for many). You're going to have to ask about a specific attribute definition type.<br>
<br>
Any plugin can have multiple dependencies.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote>
</div>
<br>
</div>
</div>
</div>
</span>
</body>
</html>