3.5.2.2 Assignments with template strings

Set mapping rules for the external IdP and Ops I in the [Identity Provider Mapping] window. Using template strings to assign values allows you to specify mapping targets even if the group, role, and attributes in Ops I do not perfectly match the values of conditions, Claim (for OIDC), or attributes (for SAML). As a result, you can set mapping targets that meet various conditions in one operation without having to register multiple mappings.

This section describes the following items:

• Description rules and examples
• Errors in template descriptions
• Common mistakes

(1) Description rules and examples

When assigning values by using template strings, you can use directives, output expressions, conditional expressions, operators, string functions, and sequence functions.
In the following, “var” represents a variable, “str” represents a string, and “list” represents a sequence.

[Directives]

The available directives are as follows:

(Table) Available directives

[Output expressions]

The available output expressions are as follows:

(Table) Available output expressions

[Conditional expressions]

The available conditional expressions are as follows:

(Table) Available conditional expressions

[Operators]

The available operators are as follows:

(Table) Available operators

[String functions]

The available string functions are as follows:

(Table) Available string functions

[Sequence (array, list) functions]

The available sequence functions are as follows:

(Table) Available sequence functions

[authn_info]

When specifying information on the external IdP side, you can use authn_info, where information of the external IdP side is stored.
The user information available in authn_info and its method of use differ between SAML and OIDC. The characteristics of authn_info in SAML and OIDC are as follows:

①For SAML:

• You can use information contained in attributes.
• You need to specify which element in the array to reference, by using an index.

Tips
Because the storage order from the external IdP side is unknown, we recommend that you use ?seq_contains().

②For OIDC:

• You can use properties included in the user information obtained from the ID token or the UserInfo endpoint.

[Statement examples]

The following shows examples using directives, output expressions, conditional expressions, operators, string functions, and sequence functions:

<#-- Comment -->

Adding the following comment: Output the role with a line break

<#if>...<#elseif>...<#else>...</#if>

Assigning the “adminGroup1” role when the external IdP’s “id” is “1”, “adminGroup2” when the external IdP’s “id” is “2”, and “customerGroup” for all other cases

<#assign var = "A">

Assigning the “portal_subscriber” role when the external IdP’s “department” is not the string “abc”

<#list items as item>...</#list>

Checking each external IdP’s “role” information stored in list format, and assigning “user_admin” and “customer_admin” when part of the string contains “admin”

${}

Assigning the “email” information as is when the “email” information on the external IdP side is not empty

var??

Assigning the “idp_user” group when the external IdP is linked

var?has_content

Assigning the “email” information as is when the “email” information on the external IdP side is not empty

==

Assigning the “portal_subscriber” role when “customer.group” in “groups” of the external IdP is the string “portal”

!

Assigning the “portal_subscriber” role when the external IdP’s “department” is not the string “abc”

!=

Assigning the “customer_group” group when the external IdP’s “customer” is not the string “123”

||

Assigning the “portal_author” role when the external IdP’s “groups” list contains “group 1” or the “role” list contains “author”

&&

Assigning the “portal_site_admin” role when the external IdP’s “groups” list contains “group 2” and the “email” information is “abc.com”

lt

When the string-type “customer (customer code)” of the external IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is less than 2000

lte

When the string-type “customer (customer code)” of the external IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is 2000 or less

gt

When the string-type “customer (customer code)” of the external IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is greater than 2000

gte

When the string-type “customer (customer code)” of the external IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is 2000 or greater

str?c_lower_case

Converting the external IdP’s “username” to lowercase, and assigning the “customer_admin” role when the value is equal to “hitachi_taro”

str?c_upper_case

Converting the external IdP’s “username” to uppercase, and assigning the “customer_admin” role when the value is equal to “HITACHI_TARO”

str?replace("A", "B")

Assigning a role with a name where the “hitachi” part of the name is replaced with “test” when “customer.group” in “groups” of the external IdP contains the string “hitachi”

str?split("A")

Treating the first separated value as the surname when the external IdP has the “name” information and the “name” value is not empty but is separated by " "

str?date("yyyy-MM-dd")

Assigning the “century_group” group when the external IdP’s date of birth information (stored in yyyy-MM-dd format) is earlier than January 1, 2000

str?number

When the string-type “customer (customer code)” of the external IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is greater than 2000

str?trim

Assigning the “idp_user” group when the external IdP’s customer information is not empty and its value is equal to 2000

str?contains("A")

Assigning the “hitachi_group” group when the external IdP’s “email” information contains the string “hitachi”

str?starts_with("A")

Assigning the “itsm_admin” role when the external IdP’s “username” information starts with the string “admin”

str?ends_with("A")

Using the external IdP’s “email” information as Ops I’s “email” information when the external IdP’s “email” ends with the string “.com”

str?matches("A")

Assigning the customer code when the external IdP’s “customer (customer code)” consists of numbers

list?seq_contains("A")

Assigning the “itsm_admin” role when one of the multiple roles held by the external IdP is the “admin” role

list?join("A")

Assigning the “role with the same name in Ops I when the external IdP has the “role” information

(2) Errors in template description

Errors will be output at the following timing if there are deficiencies in the template description.

[When saving the identity provider]

If there is a grammatical mistake, an error message will be displayed when saving the identity provider.
You can identify the problematic line by checking the “[Details]” provided in the error message.