Attribute Conversion for eduGAIN

Innen: KIFÜ Wiki
A lap korábbi változatát látod, amilyen Hege(AT)niif.hu (vitalap | szerkesztései) 2008. szeptember 3., 13:10-kor történt szerkesztése után volt. (Attribute conversion rule types)

JRA5 Attribute Conversion allows a Bridging Element administrator to define rules to transform attributes being released or received. The same logic can work in both Home and Remote Bridging Elements.

Introduction

Attributes:The Big Attribute Picture

Attributes are travelling on the wire in eduGAIN-defined format, ie. SAML. Naming attributes and defining their contents might be a standardization task of eduGAIN operators; however it should be possible for federations to agree on custom set of attributes beyond "eduGAIN commons".

Attribute Conversion only adds attributes (or values) to the attribute set; use Attribute Filtering for filtering out unnecessary attributes. It also means that if no rules match an attribute, then it will go to the filter unmodified - so conversion works with a default by-pass policy.

Attribute conversion rule concepts

Most of the rules are based on standard regular expressions and Unified Expression Language.

Each rule works on the actual attribute set which is not necessarily the initial set, as each rule can alter the set (ie. by changing values or names, adding new attributes to the set). This means that the order of the rules is important.

Every rule consists of two parts: condition and action. The condition element is used to determine whether this particular rule is to be processed or not. Thus, the rule action is only processed when all the conditions are met (a rule without any conditions is processed by default).

The condition engine now only supports regular expression -based matching rules. There is two type of matching rules

  • remote peer's name (RemoteProviderMatch)
  • attribute values (AttributeMatch)

The rule's action is to create new attributes (or to modify existing ones). Please refer to the detailed BasicRule, MergeRule, SplitRule documentation below.


Rule context

When the conversion rules are processed one after another, each rule has its own rule context bound to it. This context holds references to all the matched attributes too. The rule context is also responsible for supporting the rule's action.


Attribute conversion rule types

BasicRule

The Basic rule is the simplest attribute conversion rule type. It can create one attribute and optionally use one attribute and regular expressions to transform attribute values.

Basic Rule can create static attributes. You can archieve this by omitting the Condition node.

<BasicRule>
 <Description>Create static attribute (or replace existing if attribute with this name already exists)</Description>
 <Attribute attributeName="eduPersonScopedAffiliation" replaceValues="true">
  <AttributeValue>staff@niif.hu</AttributeValue>
 </Attribute>
</BasicRule>

The next rule is using remote provider matching to determine whether the remote side has an identifier of 'urn:geant:edugain:be:' and any hungarian domain appended to it.

<BasicRule>
  <Description>Create static attribute for some remote providers</Description>
  <Condition>
   <RemoteProviderMatch>^urn:geant:edugain:be:[^:]+\.hu$</RemoteProviderMatch>
  </Condition>
  <Attribute attributeName="homeOrganization">
   <AttributeValue>niif.hu</AttributeValue>
  </Attribute>
</BasicRule>

This example shows how to rename an attribute without converting its values. Note that you must use AttributeMatch without regular expressions to archieve this.

<BasicRule>
 <Description>Rename attribute uid to edupersonPrincipalName</Description>
 <Condition>
  <AttributeMatch attributeName="uid"/>
 </Condition>
 <Attribute attributeName="edupersonPrincipalName">
  <AttributeValue>${uid}</AttributeValue>
 </Attribute>

The next example demonstrates the use of regular expression matching groups.

<BasicRule>
 <Decription>Transform o=org,c=country style OrgDN to dns-based homeOrganization</Decription>
 <Condition>
  <AttributeMatch attributeName="edupersonOrgDN" id="regex">o=(.*),c=(.*)</AttributeMatch>
 </Condition>
 <Attribute attributeName="homeOrganization">
  <AttributeValue>${regex[1]}.${regex[2]}</AttributeValue>
 </Attribute>

This latter needs some more explanation. When you want to reference the regular expression matching groups (enclosed by parentheses), you must define the reference name with the 'id' parameter of AttributeMatch. Then, use ${id[0]} to refer to the whole regular expression match (ie. the whole attribute value), and ${id[N]} to refer to the Nth. matching group of the regular expression.


MergeRule

SplitRule

CustomRule

Quick guide for using unified EL with rules

Using name mapper

Testing

XMLTest.sh

Real-life examples