<html dir="ltr"><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="text-align:left; direction:ltr;"><div>I just finished up implementing something very similar. Rather than using a mapped attribute why not use a regex split attribute? This seems to be working well for our setup.</div><div><br></div><div> <AttributeDefinition id="memberOfMyApp" xsi:type="RegexSplit" regex="^CN=([^,]*).+,OU=MyApp,.*"></div><div> <InputDataConnector ref="myLDAP" attributeNames="memberOf" /></div><div> <AttributeEncoder xsi:type="SAML2String" name="memberOfMyApp" FriendlyName="memberOfMyApp"/></div><div> </AttributeDefinition></div><div><br></div><div>Tom Wilson</div><div>University of Wyoming Information Technology</div><div><br></div><div>-----Original Message-----</div><div><b>From</b>: IAM David Bantz via users <<a href="mailto:IAM%20David%20Bantz%20via%20users%20%3cusers@shibboleth.net%3e">users@shibboleth.net</a>></div><div><b>Reply-To</b>: Shib Users <<a href="mailto:Shib%20Users%20%3cusers@shibboleth.net%3e">users@shibboleth.net</a>></div><div><b>To</b>: Shib Users <<a href="mailto:Shib%20Users%20%3cusers@shibboleth.net%3e">users@shibboleth.net</a>></div><div><b>Cc</b>: IAM David Bantz <<a href="mailto:IAM%20David%20Bantz%20%3cdabantz@alaska.edu%3e">dabantz@alaska.edu</a>></div><div><b>Subject</b>: releasing AD group names</div><div><b>Date</b>: Fri, 08 Apr 2022 15:58:55 -0500</div><div><br></div><!-- text/html -->
<div style="border:solid red 2.25pt;padding:1.0pt 4.0pt 1.0pt 4.0pt">
<p class="MsoNormal" style="line-height:11.35pt">◆ This message was sent from a non-UWYO address. Please exercise caution when clicking links or opening attachments from external sources.</p>
</div>
<br>
<div>
<div dir="ltr">Working to integrate existing enterprise service to SAML SSO & attribute release. The service relies on users’ AD group memberships for fine-grained access control, maintained in a specific OU in AD, sorta like CN=role1,OU=MyApp,OU=enterpriseservices…
<div><br>
</div>
<div dir="ltr">I set up an attribute release/filter policy to release users' AD group memberships from that specific OU. However, turns out they do not want the full DN of the group, only the CN value, “role1”, role7”, etc. from that OU. They insist the SAML
attribute value must exactly match the CN names used in the app (i.e., “role8’, etc., not the full DN of the group). Is this a common requirement?</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">I have not figured out a release policy and/or attribute rule that would do that - perhaps not surprising given the name and function of attribute-<u><b>filter</b></u>.xml (i.e., to filter resolved attributes, not manipulate values). But perhaps
I’ve missed something clever using a combination of policy requirement and attribute rule with regex?</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">For this single service, it’s not a big deal to create a custom SP-specific mapped attribute in the attribute-resolver to contain the CN’s from the right OU, then release that custom attribute. Is that the appropriate solution? I ask because
that strategy doesn’t scale well; if there will be many services with similar need there must be a better way…</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">David St Pierre Bantz</div>
<div dir="ltr">U Alaska IAM</div>
</div>
</div>
</body></html>