Re: [Unity-idm-discuss] Attribute Statements

[Krzysztof B. <kb...@un...>]

Hi,

W dniu 13.09.2016 o 14:32, Björn Hagemeier pisze:
> Hi Krzysztof,
>
> based on the examples in the documentation, I found a much simpler way
> of defining attributes for my particular use case. My condition within
> the parent group attribute statements is now the group membership.
>
> groups contains '/parent/servers'
> groups contains '/parent/users'
>
> However, I do think that Unity should be able to work with arbitrary
> values from sub-groups. I may not have quite grasped the difference
> between eattr and eattrs, however using either one does not make a
> difference for me.
Yes, the above is another workaround as it doesn't relay on subgroup 
attributes at all. BTW this version is also more effective.

Regarding eattr and eattrs: eattr provide you direct access to the first 
value of an attribute. eattrs provide you access to all values in an 
array. So always:

eattr['foo'] == eattrs['foo'][0]

In other words eattr is just a convenience thingy for a common case of 
single valued attributes.

>
> Is it possible that urn:unicore:attrType:role is treated specially.
> Using a similar statement for urn:unicore:attrType:xlogin only uses the
> value on the particular entity.
>
> Are enumerations somehow special when it comes to dynamic attributes?
No, not really - why it worked for xlogin is that, I guess, you was not 
assigning it with a statement.

HTH,
Krzysztof