Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

When you add an attribute mapping rule there is also an option to add an attribute transform rule.

PLACEHOLDER - SCREENSHOT OF RULE SELECTORImage Added

This is for the situation situations such as:

  • where the value of an attribute is correct, but not presentable
    • e.g. turn a value of 'CN=Filius Flitwick , DN=Teaching Staff, DN=ad, DN=hogworts, DN=sch, DN=uk' into 'Professor'
  • where the value you need for an attribute is not available from your system, but you can infer it from other values that are

...

    • e.g.

...

    • if role contains Staff and house has a value, then set headOfHouse = true.

You set up attribute transform rules in a similar way to how you map permission sets:

  1. Go to Management > Connections and select the attributes tab of the connection you want to work with

  2. Click the add rule button and select the transform rule option

  3. The target name will suggest attributes that already exist in your schema. You will need to use a one of these schema attribute attributes if you want the data to be releasable to third parties or reportable under statistics. 

  4. The display name is how it will be presented in the interface when you look at an account 

  5. Define your rule or rules and whether it is any or all of them that need to be true to assign the output value

  6. Specify an output value

...


  1. Add any other rules and output values for that target

  2. Click done and save

Image Added 

Anything to watch out for?

You can have multiple transform rules with the same target name so that different rules can supply different valueshave only have one rule of any type per target attribute.

If more than one rule with the same target name set of conditions matches, then the attribute will have more than one value. All values are passed if that attribute is released, and all values are used by statistics if it is reportable. Unfortunately the interface cannot display muliti-valued attributes on accounts at the moment.

You cannot use transformed values in other transformations.If a rule is using 'any' condition, or conditions are based on any multi-valued attributes such as memberOf, then your rule can match on any of the multiple values that it sees. Negative matches such as 'does not contain' are best avoided in those cases as they can be very difficult to diagnose if they don't work as expected.

Expand
titleMulti-valued attributes

Include Page
_multivaluedattributes
_multivaluedattributes

Example

Scenario:

An organisation has offices in 20 cities around the world. The directory they have connected to OpenAthens can pass the name of the office (e.g. Abuja office), but not the country. All users have access to the same set of resources and are not separated by sub-organistaion or permission set.

...

Because we want to use this in reports, we first must set up an a text attribute in the schema editor and make sure it is marked as reportable. This example will assume one has been set up with a target name of country.

Next we add some transform rules along the lines of: when When any of these match (office contains Edinburgh, office contains Bristol) the output value is 'UK':. 

PLACEHOLDER - SCREENSHOT OF THIS RULE

Save and repeat for each country Image Added

Add conditions and outputs for each country, then click done and save.