Attribute Release Policy - Pattern Matching

This policy allows the release of defined allowed attributes only if the attribute value(s) matches the given regular expression pattern. If the attribute value is matched successfully, the policy is then able to apply transformation rules on the value to extract and collect the matched groups to then assemble the final attribute value.

• Pattern Extraction
• Inline Groovy

• Consider an authenticated principal with a memberOf attribute which contains values such as CN=g1,OU=example,DC=org, and CN=g2,OU=example,DC=org. The following policy applies the defined pattern and the transformation on each attribute value. The final result would be a memberOf attribute with values g1@example.org and g2@example.org.

  1
  2
  3
  4
  5
  6
  7
  8
  9
  10
  11
  12
  13
  14
  15
  16
  17
  {
    "@class" : "org.apereo.cas.services.CasRegisteredService",
    "serviceId" : "...",
    "name" : "sample",
    "id" : 300,
    "attributeReleasePolicy" : {
      "@class": "org.apereo.cas.services.PatternMatchingAttributeReleasePolicy",
      "allowedAttributes": {
          "@class": "java.util.TreeMap",
          "memberOf": {
              "@class": "org.apereo.cas.services.PatternMatchingAttributeReleasePolicy$Rule",
              "pattern": "^CN=(\\w+),\\s*OU=(\\w+),\\s*DC=(\\w+)",
              "transform": "${1}@${2}/${3}"
          }
      }
    }
  }
  

  Matched pattern groups typically start at 1. If you need to refer to the entire matched region, use ${0}.

• Consider an authenticated principal with a memberOf attribute which contains values such as CN=g1,OU=example,DC=org, and CN=g2,OU=example,DC=org. The following policy applies the defined pattern and the transformation on each attribute value.

  1
  2
  3
  4
  5
  6
  7
  8
  9
  10
  11
  12
  13
  14
  15
  16
  17
  18
  19
  20
  21
  22
  23
  24
  25
  {
    "@class" : "org.apereo.cas.services.CasRegisteredService",
    "serviceId" : "...",
    "name" : "sample",
    "id" : 300,
    "attributeReleasePolicy" : {
      "@class": "org.apereo.cas.services.PatternMatchingAttributeReleasePolicy",
      "allowedAttributes": {
          "@class": "java.util.TreeMap",
          "memberOf": {
            "@class": "org.apereo.cas.services.PatternMatchingAttributeReleasePolicy$Rule",
            "pattern": ".*CN=(\w+),OU=example.*",
            "transform":
              '''
                  groovy {
                      logger.info("Full matched value is ${matched}")
                      def value = matchedGroup1 == 'g1' ? 'group1' : 'group2'
                      // return a Map of attribute names to values
                      return [mem: [value]]
                  }
              '''
          }
      }
    }
  }
  

  The final released attribute would be mem with values group1 and group2.

  The script must return a Map of attribute names to values. A single value is released as a one-element collection, and entries without a name or without any value are ignored. When more than one rule returns the same attribute name, their values are combined.

  The following parameters are passed to the script:

  Parameter	Description
  attributes	Map of attributes currently resolved and available for release.
  logger	The object responsible for issuing log messages such as logger.info(...).
  context	The object representing the attribute release policy context carrying service, principal, etc.
  matched	The full matched value.
  matchedGroup0	Same as matched.
  matchedGroupX	Matched group where X is the group index, if the pattern uses groups.

  To prepare CAS to support and integrate with Apache Groovy, please review this guide.