Symantec Access Management

 View Only

Need some help with creating a virtual attribute using expression

  • 1.  Need some help with creating a virtual attribute using expression

    Posted Jun 26, 2019 06:31 PM
    ​Hi folks,

    I have this expression - - > Filter(ENUMERATE(memberOf, STRING(RDN(STRING(%0), FALSE))), '*HR_*')

    This expression works beautifully, extracting all of the "*HR_*" AD groups that the user belongs to in the "memberOf" attribute.  The problem I am having is that there are multiple entries that matches "*HR_*" such as:
    1) CN=HR_Admin, ou=DEV,ou=groups, dc=company, dc=com
    2) CN=HR_Admin, ou=UAT,ou=groups, dc=company, dc=com
    3) CN=HR_Admin, ou=PROD,ou=groups, dc=company, dc=com

    So the virtual attribute returns value of  - - > "HR_Admin^HR_Admin^HR_Admin"

    If I am configuring this in my SiteMinder DEV environment then I only want it to only look for - - > CN=HR_Admin, ou=DEV,ou=groups, dc=company, dc=com

    and will only create one value "HR_Admin".

    The solution would be to create an additional filter condition that looks for "*HR_*" + "ou=DEV", then condition = TRUE.  I came across the "LIKE" expression operator and tried this - - > Filter(ENUMERATE(memberOf, STRING(RDN(STRING(%0), FALSE))), 'CN=HR_ou=DEV' LIKE '????????????'  but I got syntax error when trying to save.

    Fatal: Failed to execute ModifyAttributeMappingEvent. ERROR MESSAGE: SmApiWrappedException:Invalid argument #2 for function "Filter". Should be <string>, found <boolean>.