​Hello Community,

I was wondering if you could help me with this (I think) small problem. If the question was already asked I am sorry but I tried my best to search for a solution before.

So my problem is : in my module chain I have the following elements

1- Default IVCred Token (mode : validate)
2- Default Map Module (mode : map)
3- Default SAML 2.0 Token (mode : issue)

Basically in the map module, I use a script to manipulate data based on what our partner needs because sometimes I need to do some rewrite from IDP attributes.

I need to return an attribute's value with the character "<" in it, however no matter what I tried I still see this &lt; in the header:

<saml:Attribute Name="Just_To_Be_Sure" NameFormat="urn:ibm:names:ITFIM:5.1:accessmanager"><saml:AttributeValue xsi:type="xs:string">BLABLABLA - &lt;</saml:AttributeValue>

(mapping source :

 function cleanup_multiple_attributes(cleanup_string) {
     cleanup_string = cleanup_string .replace(/&lt;/g,/</);
     return unescape(cleanup_string);
 }

temp = unescape(cleanup_multiple_attributes("<"));
stsuu.addAttribute(new Attribute("Just_To_Be_Sure", "urn:ibm:names:ITFIM:5.1:accessmanager", "BLABLABLA - " + unescape(temp)));
)


I was wondering if there is a way to add such a character (< or >) as strings in the token values. If this is not possible, do you know if there is a way add multiple values for one attribute, something like this :

<saml:Attribute Name="GROUP_MEMBERSHOP">
            <saml:AttributeValue xsi:type="xs:string">GROUP1</saml:AttributeValue>
            <saml:AttributeValue xsi:type="xs:string">GROUP2</saml:AttributeValue>
            <saml:AttributeValue xsi:type="xs:string">GROUP3</saml:AttributeValue>
</saml:Attribute>


Thank you very much,

------------------------------
Christophe Agostini
------------------------------

Hello Christopher,

If your ultimate goal is to create a multi-valued attribute, here is an example for groups :

// Get an Iterator of the groups from the principal : 
var groupIter = stsuu.getGroups();
var groupSize = stsuu.getNumberOfGroups();

// Initialize the groups variable
var groups;

if(groupSize >0){ 
   groups = java.lang.reflect.Array.newInstance(java.lang.String, groupSize);
} else {
   IDMappingExtUtils.traceString("User has not groups");
}
 
IDMappingExtUtils.traceString(groups.constructor.toString()); 
 
var currentGroup = ""; 
var i = 0; 
while(groupIter.hasNext()){ 
    // While there are still groups, add the groups to an array 
    currentGroup = groupIter.next().getName(); 
    IDMappingExtUtils.traceString("Current Group : " + currentGroup); 
    groups[i] = (currentGroup); 
        i++; 
} 
 
stsuu.addAttribute(new 
Attribute("groups","urn:ibm:names:ITFIM:5.1:accessmanager", groups));

This should give you your desired result and add a multi-valued attribute named 'groups' to your SAML Assertion.

------------------------------
JACK YARBOROUGH
------------------------------

Hello Jack,

Thanks a lot I can clearly see how useful this could be for groups (stsuu.getGroups(); ). However groups membership was just an example, my needs is a bit different.

Let's say that I want to generate the following attribute :

<saml:Attribute Name="APPX_ROLES">
            <saml:AttributeValue xsi:type="xs:string">IT_VIEW</saml:AttributeValue>
            <saml:AttributeValue xsi:type="xs:string">Canada</saml:AttributeValue>
            <saml:AttributeValue xsi:type="xs:string">Australia</saml:AttributeValue>
     <saml:AttributeValue xsi:type="xs:string">Non_Production</saml:AttributeValue>
</saml:Attribute>


The values are not directly from the IV-CREDS but rather generated based on information in it (is the user member of the IT group ? If so, is he a member of the app admin group ? Then IT_VIEW, otherwise IT_ADMIN , etc......).

What does not seems to work is the following line :

stsuu.addAttribute(new Attribute("APPX_ROLES", "urn:ibm:names:ITFIM:5.1:accessmanager", values));

where values is an array (values[0]="IT_VIEW" , etc.). I also try to loop in all arrays values (foreach) and add something like this :

stsuu.addAttribute(new Attribute("APPX_ROLES", "urn:ibm:names:ITFIM:5.1:accessmanager", values[x]));

sadly without success either. I am wondering what I am missing.

------------------------------
Christophe Agostini
------------------------------

Original Message:
Sent: Thu June 20, 2019 03:39 PM
From: JACK YARBOROUGH
Subject: Mapping rule in ISAM 9 Federation module : replace <

Hello Christopher,

If your ultimate goal is to create a multi-valued attribute, here is an example for groups :

// Get an Iterator of the groups from the principal : var groupIter = stsuu.getGroups();
var groupSize = stsuu.getNumberOfGroups();

// Initialize the groups variable
var groups;

if(groupSize >0){    groups = java.lang.reflect.Array.newInstance(java.lang.String, groupSize);
} else {
   IDMappingExtUtils.traceString("User has not groups");
} IDMappingExtUtils.traceString(groups.constructor.toString());  var currentGroup = ""; var i = 0; while(groupIter.hasNext()){     // While there are still groups, add the groups to an array     currentGroup = groupIter.next().getName();     IDMappingExtUtils.traceString("Current Group : " + currentGroup);     groups[i] = (currentGroup);         i++; }  stsuu.addAttribute(new Attribute("groups","urn:ibm:names:ITFIM:5.1:accessmanager", groups));

This should give you your desired result and add a multi-valued attribute named 'groups' to your SAML Assertion.

------------------------------
JACK YARBOROUGH
------------------------------

Jack,

  When i used your sample code as reference to include multi valued attribute as part of the SAML assertion, i am getting constructor  error at line IDMappingExtUtils.traceString(groups.constructor.toString());. From the logs the messages reads  as "Caused by: org.mozilla.javascript.EcmaError: TypeError: Cannot read property "constructor" from undefined". I have attached my code file also to this. Any suggestions would be greatly appreciated.

Thanks
Venkata Kuchipudi

------------------------------
venkata kuchipudi
------------------------------

Original Message:
Sent: Thu June 20, 2019 03:39 PM
From: JACK YARBOROUGH
Subject: Mapping rule in ISAM 9 Federation module : replace <

Hello Christopher,

If your ultimate goal is to create a multi-valued attribute, here is an example for groups :

// Get an Iterator of the groups from the principal : var groupIter = stsuu.getGroups();
var groupSize = stsuu.getNumberOfGroups();

// Initialize the groups variable
var groups;

if(groupSize >0){    groups = java.lang.reflect.Array.newInstance(java.lang.String, groupSize);
} else {
   IDMappingExtUtils.traceString("User has not groups");
} IDMappingExtUtils.traceString(groups.constructor.toString());  var currentGroup = ""; var i = 0; while(groupIter.hasNext()){     // While there are still groups, add the groups to an array     currentGroup = groupIter.next().getName();     IDMappingExtUtils.traceString("Current Group : " + currentGroup);     groups[i] = (currentGroup);         i++; }  stsuu.addAttribute(new Attribute("groups","urn:ibm:names:ITFIM:5.1:accessmanager", groups));

This should give you your desired result and add a multi-valued attribute named 'groups' to your SAML Assertion.

------------------------------
JACK YARBOROUGH
------------------------------

Christophe,

It should be possible to create a new Attribute(java.lang.String name, java.lang.String type, java.lang.String[] values)

Perhaps the issue is that you are using a JavaScript string array and not a java.lang.String[] ?

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

From sample mapping rule:

// Method for converting JavaScript array into Java array.
// This is used for building Java Array needed for multi-value SAML Attribute.
function jsToJavaArray(jsArray) {
var javaArray = Packages.java.lang.reflect.Array.newInstance(java.lang.String, jsArray.length);
for (var i = 0; i < jsArray.length; i++) {
javaArray[i] = jsArray[i];
}
return javaArray;
}

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Original Message:
Sent: Fri June 21, 2019 10:52 AM
From: Jon Harry
Subject: Mapping rule in ISAM 9 Federation module : replace <

Christophe,

It should be possible to create a new Attribute(java.lang.String name, java.lang.String type, java.lang.String[] values)

Perhaps the issue is that you are using a JavaScript string array and not a java.lang.String[] ?

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------