Grouper Users - Open Discussion List

[Jeffrey Williams <>]

Interestingly enough, I have an example of doing just that in PSPNG for bushy group provisioning to strip out the org stem from group.name.

changeLog.consumer.pspng_personBushyLdap.groupCreationLdifTemplate = dn: ${utils.bushyDn(group.name,"cn","ou").replace(",ou=uncg","")}||cn: ${group.extension}||objectclass: group

It'll accept regex as well.  Is that what you're looking for?

On Thu, Sep 20, 2018 at 1:25 PM Bee-Lindgren, Bert <> wrote:

Scott,

I think provisionedAttributeValueFormat is the gateway to some existing solutions, or perhaps a place to add enhancements...

Since group.name is a java string, some manipulations (like removing a prefix or some regex processing are possible).

I also wonder if there is a Pattern.compile(regex).matcher(group.name).group(#) _expression_ that would enable more regex manipulation. I'll have to test this to see what is possible and what might be missing.

Please let me know what you think.

Thanks,

  Bert

---

From: <> on behalf of Scott Koranda <>
Sent: Thursday, September 20, 2018 10:52 AM
To: Bee-Lindgren, Bert
Cc:
Subject: Re: [grouper-users] Poll: Grouper 2.4 and (Old) PSP

 

Hi,

> What features do you use within PSP that are missing in PSPNG?

The PSP by its nature allows for finer grained control over how details
are provisioned. Because the PSP includes functionality from the
Shibboleth libraries one can configure sophisticated transformations on
the data before it is provisioned. I have used that functionality in a
couple of deployments to work around "interesting" challenges.

As a concrete example here is a snippet from a psp-resolver.xml file
that uses a regex to strip off a prefix from the group name before it is
provisioned as the value for the isMemberOf attribute on a person
record:

  <resolver:AttributeDefinition
    id="memberIsMemberOf"
    xsi:type="Mapped" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
    sourceAttributeID="name">
    <resolver:Dependency ref="memberIsMemberOfUnfiltered" />
    <ValueMap>
        <ReturnValue>$1</ReturnValue>
        <SourceValue>(^My\sPrefix:.+)</SourceValue>
    </ValueMap>
  </resolver:AttributeDefinition>

I do not immediately see how to do that with the PSPNG. I see the
'provisionedAttributeValueFormat' configuration option, but I do not see
how I can configure an arbitrary regex transformation.

I would be happy to learn how the PSPNG can currently provide the same
functionality.

Thanks,

Scott K

--

Jeffrey Williams 

Identity Engineer
Identity & Access Services
https://its.uncg.edu