Módosítások

Attributes are travelling on the wire in eduGAIN-defined format, ie. SAML. Naming attributes and defining their contents might be a standardization task of eduGAIN operators; however it should be possible for federations to agree on custom set of attributes ''beyond "eduGAIN commons"''.

Basic Rule can create static attributes. You can archieve achieve this by omitting the Condition node. The <code>replaceValues </code> parameter is true by default, so if you want to append values to (probably) existing attributes, you must declare it using <code>replaceValues="false"</code>. Also note that you can use multiple AttributeValue nodes.

 The next rule is using remote provider matching to determine whether the remote side has an identifier of 'urn:geant:edugain:be:' and any hungarian Hungarian domain appended to it.

 This example shows how to rename an attribute without converting its values. Note that you must use <code>AttributeMatch </code> without regular expressions to archieve achieve this.

<Decription>Transform 'o=org,c=country '-style OrgDN to dnsDNS-based homeOrganization</Decription>

This latter last example needs some more explanation. When you want to reference the regular expression matching groups (enclosed by parentheses), you must define the reference name with the 'id' parameter of <code>AttributeMatch</code>. Then, use <code>${id[0]} </code> to refer to the whole regular expression match (ie. the whole attribute value), and <code>${id[N]} </code> to refer to the Nth. matching group of the regular expression. {{INFO|You cannot reference other rule's regular expressions.}}

The merge rule can merge two or more attributes into one. The attributes which whose values you want to merge is declared using the InputAttribute node. You can also use the condition node, but only with <code>RemoteProviderMatch </code> (<code>AttributeMatch </code> is ignored). 

You can also use regular expressions, as with '''BasicRule'''.

The '''SplitRule ''' is very similar to the '''MergeRule''', the only difference is that the '''SplitRule ''' containes one <code>InputAttribute </code> and more <code>Attribute </code> nodes.

<Description>Split the edupersonScopedEntitlement edupersonScopedAffiliation to edupersonEntitlement edupersonAffiliation and homeOrganization</Description> <InputAttribute attributeName="edupersonScopedEntitlementedupersonScopedAffiliation" id="scopedEntitlementscopedAffiliation" >^([^@]+)@(.+)$</InputAttribute> <Attribute attributeName="edupersonEntitlementedupersonAffiliation"> <AttributeValue>${scopedEntitlementscopedAffiliation[1]}</AttributeValue>

<AttributeValue>${scopedEntitlementscopedAffiliation[2]}</AttributeValue>

When If you need to programatically create new attributes from program (eg. appending generated identifiers), you can use the CustomRule type.

'''CustomRule ''' class must implement the <code>net.geant.edugain.attributes.rules.Rule </code> interface, configuration can be read with the DOM API. Please refer to the Attribute Converter JavaDOC, and see the test package as it containes contains a sample implementation.

In order to archieve For interoperability, the SAML AttributeStatement carries attribute names with URN-style attribute naming scheme. For example, the 'mail' logical attribute name can be named as <code>'urn:mace:dir:attribute-def:mail'</code>, or <code>'urn:oid:0.9.2342.19200300.100.1.3'</code>. Shibboleth2 further encourages federations to use the latter form (ie. the LDAP oid).

The eduGAIN Attribute Converter library comes with AttributeName an attribute name mapping subsystem. With the help of the attribute name mapper, system administrators can '''system administrators can write the attribute converter configuration independently of the currently used AttributeStatement Attribute attribute name formatin AttributeStatement'''.

As the attribute conversion sits between two federations (and probably two attribute naming schemes), there are two types of physical attributes: the 'input' and 'output' attributes. Note that these notation is different in Home and Remote BEs: Home BE releases attributes to the eduGAIN federation, Remote BE releases attributes to the local federation. '''So the eduGAIN format is the ''' 'output' attribute format of the Home BE, and the 'input' format of the Remote BE.'''

{| border="1"{{wikitable}}

|rowspan="2"| <center>'''mail'''</center>