<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Peter,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
It's a multi-valued LDAP attribute. Using the AACLI as Keith suggested (duh!) made it easy to verify that the mapped attribute definition was doing the right thing.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Peter Schober via users <users@shibboleth.net><br>
<b>Sent:</b> Tuesday, March 22, 2022 2:24 AM<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Cc:</b> Peter Schober <peter.schober@univie.ac.at><br>
<b>Subject:</b> Re: behavior of mapped attribute definition</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">[This email originated from outside of OSU. Use caution with links and attachments.]<br>
<br>
* Morgan, Andrew J <morgan@oregonstate.edu> [2022-03-18 20:15]:<br>
> What value(s) are stored in entitlement_dx if the user has multiple<br>
> matching sourceValues (group memberships)? For example, these<br>
> matching groups:<br>
><br>
> ismemberof: cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu<br>
> cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu<br>
> cn=dx-admin,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu<br>
> cn=dx-masquerade,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu<br>
<br>
Is that stored verbatim like above (a single 'ismemberof' attribute<br>
with multiple values separated by whitespace) or actually more like this:<br>
<br>
ismemberof: cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu<br>
ismemberof: cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu<br>
ismemberof: cn=dx-admin,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu<br>
ismemberof: cn=dx-masquerade,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu<br>
<br>
If the latter then you should be fine. (Though note that your regex is<br>
not anchored -- does not start with '^' nor end with '$' so may match<br>
more than you'd expect.)<br>
<br>
If the former you'd need a script to split the values on whitespace<br>
and iterate over then: Assuming the single value of the 'ismemberof'<br>
has all the groups in one string your current regex would match<br>
'cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu cn=dxMasquerade,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu'<br>
as a /single/ entitlement value string.<br>
If you added an anchor to the beginning of the regex (to make it start<br>
with '^') the resulting value would be<br>
'cn=dxAdmin,ou=policy,ou=service,ou=dx,ou=app,ou=grouper,ou=groups,o=orst.edu'<br>
which is less bad (now it's only a single group as a single value) but<br>
still not what's desired as it misses the second group<br>
(cn=dxMasquerade) that's intended to be matched.<br>
<br>
-peter<br>
--<br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=04%7C01%7Cmorgan%40oregonstate.edu%7C69933dbc3a364f23dd7908da0be5c81b%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637835378781107108%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=d79%2FF9djYoj8HGAK%2B1kxW2H6w4xSGahzsY7jbkf5E8M%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=04%7C01%7Cmorgan%40oregonstate.edu%7C69933dbc3a364f23dd7908da0be5c81b%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637835378781107108%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=d79%2FF9djYoj8HGAK%2B1kxW2H6w4xSGahzsY7jbkf5E8M%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>