<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 4/29/2022 1:27 PM, Zach Hanson-Hart
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:BL1PR11MB5368F6CCC88680774FDCAAD0B5FC9@BL1PR11MB5368.namprd11.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css" style="display:none;">P {margin-top:0;margin-bottom:0;}</style>
<div style="font-family: Consolas, Courier, monospace; font-size:
12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255,
255);" class="elementToProof">
We have LDAP groups (object classes: eduMember,
organizationalUnit). These have delegated management in various
OUs, and each SP would have groups under some base DN. </div>
<div style="font-family: Consolas, Courier, monospace; font-size:
12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255,
255);" class="elementToProof">
<br>
</div>
<div style="font-family: Consolas, Courier, monospace; font-size:
12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255,
255);" class="elementToProof">
We want to release only the leaf OU for groups that are under a
base DN, where the base DN is dependent on the SP. That is, we
want to filter per SP based on the full DN, but release only the
leaf OU.
<br>
</div>
[...]<br>
<div style="font-family: Consolas, Courier, monospace; font-size:
12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255,
255);" class="elementToProof">
We could create a scripted attribute resolver that takes the DNs
and does the logic of figuring out what to include. But, it
sounds like that requires a separate attribute per SP, and again
would not scale well.
<br>
</div>
</blockquote>
<p><br>
</p>
<p>This was the first solution that came to my mind; the question
would be whether the script has access to the SP entity ID at
attribute resolution time (I think it does, but you might have to
do a little work to extract it from the
ProfileRequestContext->RelyingPartyContext).</p>
<p><br>
</p>
<p>If not scripting a filter seems like a reasonable choice; again
using the SP entity ID to identify a base DN to release.<br>
</p>
<p><br>
</p>
<p>Both of these assume you have some means of deriving the base DN
from the SP entity ID, either directly, or (less scalably) a
mapping table.<br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>