Re: [Unity-idm-discuss] attribute statement genereated attribute in attribute statement

[Krzysztof B. <kb...@un...>]

W dniu 14.12.2022 o 15:47, Krzysztof Benedyczak pisze:
> Dear Sander,
>
> W dniu 13.12.2022 o 09:35, Sander Apweiler pisze:
>> Dear Krzysztof,
>> we are using attribute statements to create some attributes. One of
>> them is are the internal entitlements, where we express group
>> membership information in a specific format. When we started to
>> configure the SCIM API, we encountered that we can release here only
>> single attributes but can not merge two attributes like we did in
>> SAML/Oauth output translation profiles. For this reason we created
>> another attribute statement, which merges external and internal
>> entitlements. Sadly this only works for the external entitlements, but
>> not for the internals (created by attribute statements). So my
>> questions is, can I use attributes, which was created by an attribute
>> statement within another attribute statement?
>
> To answer the specific question: yes, an attribute statement 
> generating a dynamic can use a dynamic attribute generated by other 
> attribute statement, however only in another group (i.e. such other 
> dynamic attribute can be only accessed using the eattr variable).
>
> Regarding your specific problem, let me ensure if I understand it 
> completely.
>
> So you have internalEntitlements dynamic attribute and a regular 
> attribute with externalEntitlements. Now you want to output over SCIM 
> API an attribute which will have a union of values of 
> internalEntitlments and externalEntitlments? 

Maybe an additional explanation: I'm asking, as I think that the above 
case is supported in SCIM configuration, and so I guess your scenario is 
more complex.