...
After each query is performed, the resolver applies the attribute extractor and filter configured for the application before continuing with other queries and eventually returning the resulting attributes. Each filtering step will operate on only the attributes extracted as a result of a particular query, and the filter policies can be expressed in terms of the actual "issuer" of each set of attributes for fine-grained control.
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
<!-- Uses eduPersonPrincipalName from IdP to query, and asks for eduPersonEntitlement. -->
<AttributeResolver type="SimpleAggregation" attributeId="eppn" format="urn:oid:1.3.6.1.4.1.5923.1.1.1.6">
<Entity>https://ieee.org/idp/shibboleth</Entity>
<EntityReference>External-Links</EntityReference>
<saml2:Attribute xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" FriendlyName="eduPersonEntitlement"/>
</AttributeResolver>
|
...
Finally, the caseSensitive attribute specifies whether the containng <Regex> element's match expression is to be interpreted case-sensitively. It is a boolean that defaults to "true".
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
<AttributeResolver type="Transform" source="displayName">
<Regex match="^(.+) (.+)$" dest="givenName">$1</Regex>
<Regex match="^(.+) (.+)$" dest="sn">$2</Regex>
<Regex match="^(.+) (.+)$">$2, $1</Regex>
</AttributeResolver>
|
...
The first attribute object found with a particular ID is used, and all of the attributes supplied must contain the same number of values, or the plugin is not applied. It works best with simple combinations of single-valued attributes.
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
<AttributeResolver type="Template" sources="givenName sn" dest="displayName">
<Template>$givenName $sn</Template>
</AttributeResolver>
|
...