Script Attribute Definition Examples
The following examples are simply that, examples. They do not illustrate all possible configuration properties or features. Refer to script attribute definition for this information.

Generate Unique Opaque Identifier
Contributed by: Lukas Haemmerle, SWITCH, Switzerland
This example generates an unique, opaque, identifier based off of an identifier from another attribute. This is approach is useful when an opaque identifier is necessary but is not available in the user data store.
<resolver:AttributeDefinition xsi:type="Script" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
id="swissEduPersonUniqueID"
sourceAttributeID="uidNumber">
<!-- Dependency that provides the source attribute. -->
<resolver:Dependency ref="myLDAP" />
<!-- SAML 1 and 2 encoders for the attribute. -->
<resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:mace:switch.ch:attribute-def:swissEduPersonUniqueID" />
<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:2.16.756.1.2.5.1.1.1"
friendlyName="swissEduPersonUniqueID" />
<!-- The script, wrapped in a CDATA section so that special XML characters don't need to be removed -->
<Script><![CDATA[
// Import Shibboleth attribute provider
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
// Import Apache commons codecs
importPackage(Packages.org.apache.commons.codec.digest);
// Get the unique value
uniqueValue = uidNumber.getValues().get(0) + "some#salt#value#12345679";
// Create md5 value
localpart = DigestUtils.md5Hex(uniqueValue);
// Get attribute to add
swissEduPersonUniqueID = new BasicAttribute("swissEduPersonUniqueID");
// Prepend unique and pseudo-random localpart to domain name
swissEduPersonUniqueID.getValues().add(localpart + "@switch.ch");
]]></Script>
</resolver:AttributeDefinition>
|
|

Generate Affiliation based on Groups
Contributed by: Halm Reusser, SWITCH, Switzerland
This example demonstrates the generation of values for the eduPersonAffiliation
attribute based on the group membership attribute memberOf
.
Group membership in many LDAP directories is carried in the memberOf attribute. In Novell's eDirectory it is carried in the groupMembership attribute. |
<resolver:AttributeDefinition xsi:type="Script" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
id="eduPersonAffiliation"
sourceAttributeID="eduPersonAffiliation">
<!-- Dependency that provides the source attribute. -->
<resolver:Dependency ref="myLDAP" />
<!-- SAML 1 and 2 encoders for the attribute. -->
<resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:mace:dir:attribute-def:eduPersonAffiliation" />
<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
friendlyName="eduPersonAffiliation" />
<!-- The script, wrapped in a CDATA section so that special XML characters don't need to be removed -->
<Script><![CDATA[
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
// Create attribute to be returned from definition
eduPersonAffiliation = new BasicAttribute("eduPersonAffiliation");
// Add at least one value
eduPersonAffiliation.getValues().add("affiliate");
// If the user has group membership
if (typeof memberOf != "undefined" && memberOf != null ){
// The go through each group membership and add the appropriate affiliation
// The IdP will remove duplicate values so we don't need to worry about that here
for ( i = 0; memberOf != null && i < memberOf.getValues().size(); i++ ){
value = memberOf.getValues().get(i);
if (value.indexOf("OU=Students") > 0){
eduPersonAffiliation.getValues().add("student");
}
if (value.indexOf("OU=Teachers") > 0){
eduPersonAffiliation.getValues().add("faculty");
eduPersonAffiliation.getValues().add("staff");
}
if (value.indexOf("OU=Staff") > 0){
eduPersonAffiliation.getValues().add("staff");
}
}
}
]]></Script>
</resolver:AttributeDefinition>
|
|

Add common-lib-terms to all Staff and Students
Contributed by: Halm Reusser, SWITCH, Switzerland
This example adds the common-lib-terms URN to the eduPersonEntitlement
attribute for a principal with affiliation staff
or student
while keeping any entitlement values retrieved from the directory.
<resolver:AttributeDefinition xsi:type="Script" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
id="eduPersonEntitlement"
sourceAttributeID="eduPersonEntitlement">
<!-- Dependency that provides the source attribute. -->
<resolver:Dependency ref="myLDAP" />
<resolver:Dependency ref="eduPersonAffiliation" />
<!-- SAML 1 and 2 encoders for the attribute. -->
<resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:mace:dir:attribute-def:eduPersonEntitlement" />
<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7"
friendlyName="eduPersonEntitlement" />
<!-- The script, wrapped in a CDATA section so that special XML characters don't need to be removed -->
<Script><![CDATA[
importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);
// Create attribute to be returned from definition
eduPersonEntitlement = new BasicAttribute("eduPersonEntitlement");
if (eduPersonAffiliation.getValues().contains("staff") ||
eduPersonAffiliation.getValues().contains("student")) {
eduPersonEntitlement.getValues().add("urn:mace:dir:entitlement:common-lib-terms");
}
]]></Script>
</resolver:AttributeDefinition>
|
|