<div dir="ltr"><div class="gmail_default" style="font-family:"times new roman",serif">Looks like I included the wrong reference link. Rather than the internet2 link, I used <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples#ResolverScriptAttributeDefinitionExamples-GenerateAffiliationbasedonGroups">https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples#ResolverScriptAttributeDefinitionExamples-GenerateAffiliationbasedonGroups</a> (which would be nice to have updated to Shib 3).</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><br><font face="times new roman, serif">Brian Moon</font><br><font face="times new roman, serif">Senior System Administrator</font><br><font face="times new roman, serif">Enterprise Systems</font><br><font face="times new roman, serif">Santa Clara University</font><br><font face="times new roman, serif">Office: 408.554.4830</font><br><a href="mailto:bmoon@scu.edu" style="font-family:'times new roman',serif" target="_blank">bmoon@scu.edu</a><br></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Apr 10, 2017 at 5:19 PM, Brian Moon <span dir="ltr"><<a href="mailto:bmoon@scu.edu" target="_blank">bmoon@scu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:"times new roman",serif">Hello all,</div><div class="gmail_default" style="font-family:"times new roman",serif"><br></div><div class="gmail_default" style="font-family:"times new roman",serif">I just wrote a script to map directory groups to eduPersonEntitlement strings. Everything seems to be working fine with it, although I would appreciate a code review to make sure that I haven't done anything stupid with it, or to see if there are areas that could be better optimized. To create this, I was relying on documentation available at <a href="https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition" target="_blank">https://wiki.shibboleth.<wbr>net/confluence/display/IDP30/<wbr>ScriptedAttributeDefinition</a> and <a href="https://spaces.internet2.edu/display/Grouper/Exposing+Groups+Through+Shibboleth" target="_blank">https://spaces.internet2.<wbr>edu/display/Grouper/Exposing+<wbr>Groups+Through+Shibboleth</a> (which seemed to be outdated). We are currently running IdP v3.3.1.</div><div class="gmail_default" style="font-family:"times new roman",serif"><br></div><div class="gmail_default" style="font-family:"times new roman",serif">Below is the entry in attribute-resolver.xml:</div><div class="gmail_default"><div class="gmail_default"><font face="monospace, monospace"> <AttributeDefinition xsi:type="ScriptedAttribute" id="eduPersonEntitlement"></font></div><div class="gmail_default"><font face="monospace, monospace"> <Dependency ref="MyLDAP" /></font></div><div class="gmail_default"><font face="monospace, monospace"> <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-<wbr>def:eduPersonEntitlement" encodeType="false" /></font></div><div class="gmail_default"><font face="monospace, monospace"> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.7" friendlyName="<wbr>eduPersonEntitlement" encodeType="false" /></font></div><div class="gmail_default"><font face="monospace, monospace"> <Script><![CDATA[</font></div><div class="gmail_default"><font face="monospace, monospace"> logger = Java.type("org.slf4j.<wbr>LoggerFactory").getLogger("<wbr>net.shibboleth.idp.attribute.<wbr>resolver.eppnbuilder");</font></div><div class="gmail_default"><font face="monospace, monospace"> attributeStringType = Java.type("net.shibboleth.idp.<wbr>attribute.<wbr>StringAttributeValue");</font></div><div class="gmail_default"><font face="monospace, monospace"><br></font></div><div class="gmail_default"><font face="monospace, monospace"> // Load entitlementMap</font></div><div class="gmail_default"><font face="monospace, monospace"> logger.debug("Loading entitlementMap: %{idp.home}/conf/entitlement-<wbr>map.js");</font></div><div class="gmail_default"><font face="monospace, monospace"> load("%{idp.home}/conf/<wbr>entitlement-map.js");</font></div><div class="gmail_default"><font face="monospace, monospace"><br></font></div><div class="gmail_default"><font face="monospace, monospace"> // If the user has group membership</font></div><div class="gmail_default"><font face="monospace, monospace"> if(typeof memberOf != "undefined" && memberOf != null ){</font></div><div class="gmail_default"><font face="monospace, monospace"> // Then go through each group membership and add the appropriate entitlement</font></div><div class="gmail_default"><font face="monospace, monospace"> // The IdP will remove duplicate values so we don't need to worry about that here</font></div><div class="gmail_default"><font face="monospace, monospace"> for(i = 0; memberOf != null && i < memberOf.getValues().size(); ++i){</font></div><div class="gmail_default"><font face="monospace, monospace"> // Group names here contain the CN and the full path in the directory to the group.</font></div><div class="gmail_default"><font face="monospace, monospace"> // For simplicity, only the group name is extracted from this string.</font></div><div class="gmail_default"><font face="monospace, monospace"> var groupName = memberOf.getValues().get(i).<wbr>split(",",1)[0].substring(3);</font></div><div class="gmail_default"><font face="monospace, monospace"><br></font></div><div class="gmail_default"><font face="monospace, monospace"> logger.debug("Looking for entitlements matching '" + groupName + "'");</font></div><div class="gmail_default"><font face="monospace, monospace"> var entitlements = entitlementMap[groupName];</font></div><div class="gmail_default"><font face="monospace, monospace"> if(entitlements != null && entitlements.length > 0) {</font></div><div class="gmail_default"><font face="monospace, monospace"> for(j = 0; j < entitlements.length; ++j) {</font></div><div class="gmail_default"><font face="monospace, monospace"> logger.debug("Adding entitlement of " + entitlements[j]);</font></div><div class="gmail_default"><font face="monospace, monospace"> eduPersonEntitlement.addValue(<wbr>new attributeStringType(<wbr>entitlements[j]));</font></div><div class="gmail_default"><font face="monospace, monospace"> }</font></div><div class="gmail_default"><font face="monospace, monospace"> }</font></div><div class="gmail_default"><font face="monospace, monospace"> }</font></div><div class="gmail_default"><font face="monospace, monospace"> }</font></div><div class="gmail_default"><font face="monospace, monospace"> ]]></Script></font></div><div class="gmail_default"><font face="monospace, monospace"> </AttributeDefinition></font></div><div class="gmail_default"><font face="times new roman, serif"><br></font></div><div class="gmail_default"><font face="times new roman, serif">Below is the content of the %{idp.home}/conf/</font><span style="font-family:"times new roman",serif">entitleme<wbr>nt-map.js file:</span></div><div class="gmail_default"><div class="gmail_default"><font face="monospace, monospace">/**</font></div><div class="gmail_default"><font face="monospace, monospace"> * This file containts the mappings of group memberships to</font></div><div class="gmail_default"><font face="monospace, monospace"> * eduPeronEntitlement. Mappings should be in the following format:</font></div><div class="gmail_default"><font face="monospace, monospace"> * "Group Name": [</font></div><div class="gmail_default"><font face="monospace, monospace"> * "urn:mace:yourNamespace:<wbr>entitlement:xxxx",</font></div><div class="gmail_default"><font face="monospace, monospace"> * "urn:mace:yourNamespace:<wbr>entitlement:yyyy"</font></div><div class="gmail_default"><font face="monospace, monospace"> * ],</font></div><div class="gmail_default"><font face="monospace, monospace"> *</font></div><div class="gmail_default"><font face="monospace, monospace"> * This data structure was chosen to allow for fast lookups of directory groups</font></div><div class="gmail_default"><font face="monospace, monospace"> * to see if there are any associated entitlements. The entitlements listed</font></div><div class="gmail_default"><font face="monospace, monospace"> * for each group are in the form of an array so that it will be able to support</font></div><div class="gmail_default"><font face="monospace, monospace"> * multiple entitlements for a single group.</font></div><div class="gmail_default"><font face="monospace, monospace"> */</font></div><div class="gmail_default"><font face="monospace, monospace">var entitlementMap = {</font></div><div class="gmail_default"><font face="monospace, monospace"><br></font></div><div class="gmail_default"><font face="monospace, monospace"> // Application1 Entitlement</font></div><div class="gmail_default"><font face="monospace, monospace"> "Entitlement-Application1": [</font></div><div class="gmail_default"><font face="monospace, monospace"> "<a href="https://entitlement/URL/for/Application1" target="_blank">https://entitlement/URL/for/<wbr>Application1</a>",</font></div><div class="gmail_default"><font face="monospace, monospace"> "urn:mace:yourNamespace:<wbr>entitlement:application1"</font></div><div class="gmail_default"><font face="monospace, monospace"> ],</font></div><div class="gmail_default"><font face="monospace, monospace">};</font></div><div class="gmail_default"><font face="monospace, monospace"><br></font></div><div class="gmail_default"><font face="times new roman, serif">Thanks!</font></div></div></div><span class="HOEnZb"><font color="#888888"><div><div class="m_774940327501912581gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><br><font face="times new roman, serif">Brian Moon</font><br><font face="times new roman, serif">Senior System Administrator</font><br><font face="times new roman, serif">Enterprise Systems</font><br><font face="times new roman, serif">Santa Clara University</font><br><font face="times new roman, serif">Office: <a href="tel:(408)%20554-4830" value="+14085544830" target="_blank">408.554.4830</a></font><br><a href="mailto:bmoon@scu.edu" style="font-family:"times new roman",serif" target="_blank">bmoon@scu.edu</a><br></div></div></div></div></div></div></div></div></div></div></div>
</font></span></div>
</blockquote></div><br></div>