3.6.2.2 Assignments with template strings

The [Identity Provider Mapping] window is used to configure mapping rules between IdP user information and Ops I user information. Using template strings to assign values allows you to specify mapping targets even if the group, role, and attributes in Ops I do not perfectly match the values of conditions, Claim (for OIDC), or attributes (for SAML). As a result, you can set mapping targets that meet various conditions in one operation without having to register multiple mappings.

This section describes the following items:

• Description rules and examples
• Errors that occur when configuring the identity provider
• Common mistakes

(1) Description rules and examples

When assigning values by using template strings, you can use directives, output expressions, conditional expressions, operators, string functions, and sequence functions.
In the following, “var” represents a variable, “str” represents a string, and “list” represents a sequence.

[Directives]

The available directives are as follows:

(Table) Available directives

[Output expressions]

The available output expressions are as follows:

(Table) Available output expressions

[Conditional expressions]

The available conditional expressions are as follows:

(Table) Available conditional expressions

[Operators]

The available operators are as follows:

(Table) Available operators

[String functions]

The available string functions are as follows:

(Table) Available string functions

[Sequence (array, list) functions]

The available sequence functions are as follows:

(Table) Available sequence functions

[authn_info]

Used to view IdP user information.
The user information available in authn_info and its method of use differ between SAML and OIDC. The characteristics of authn_info in SAML and OIDC are as follows:

①For SAML:

• You can use information contained in attributes.
  For mapping using templates, the Attribute Name is used as the key, and the corresponding value is stored in authn_info as an array. Single values are also treated as arrays.
  
  Example: When the IdP information "preferred_username" is equal to "test_user"
  <#if authn_info["preferred_username"][0]=="test_user">
• Use an index (example: [0]) only when you want to specify which element of the array to use.
  Example: ${authn_info["email"][0]}
  If the array has multiple elements, [1] or other indices can also be specified in addition to [0]. An index does not need to be specified in the following cases:
  • Conditional expressions, such as existence checks (??) and empty checks (?has_content):
    These are applied to the entire expression rather than to individual elements of the array.
  • Functions for arrays (sequences):
    Values are stored in authn_info as arrays.
    Example: authn_info["groups"]?seq_contains("admin")

②For OIDC:

• You can use properties included in the user information obtained from the ID token or the UserInfo endpoint.

[Statement examples]

The following shows examples using directives, output expressions, conditional expressions, operators, string functions, and sequence functions:

<#-- Comment -->

Adding the following comment: Output the role with a line break

<#if>...<#elseif>...<#else>...</#if>

Assigning the “adminGroup1” role when the IdP’s “id” is “1”, “adminGroup2” when the IdP’s “id” is “2”, and “customerGroup” for all other cases

<#assign var = "A">

Assigning the “portal_subscriber” role when the IdP’s “department” is not the string “abc”

<#list items as item>...</#list>

Checking each IdP’s “role” information stored in list format, and assigning “user_admin” and “customer_admin” when part of the string contains “admin”

${}

Assigning the “email” information as is when the “email” information on the IdP side is not empty

var??

Assigning the “idp_user” group when the IdP is linked

var?has_content

Assigning the “email” information as is when the “email” information on the IdP side is not empty

==

Assigning the “portal_subscriber” role when “customer.group” in “groups” of the IdP is the string “portal”

!

Assigning the “portal_subscriber” role when the IdP’s “department” is not the string “abc”

!=

Assigning the “customer_group” group when the IdP’s “customer” is not the string “123”

||

Assigning the “portal_author” role when the IdP’s “groups” list contains “group 1” or the “role” list contains “author”

&&

Assigning the “portal_site_admin” role when the IdP’s “groups” list contains “group 2” and the “email” information is “abc.com”

lt

When the string-type “customer (customer code)” of the IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is less than 2000

lte

When the string-type “customer (customer code)” of the IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is 2000 or less

gt

When the string-type “customer (customer code)” of the IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is greater than 2000

gte

When the string-type “customer (customer code)” of the IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is 2000 or greater

str?c_lower_case

Converting the IdP’s “username” to lowercase, and assigning the “customer_admin” role when the value is equal to “hitachi_taro”

str?c_upper_case

Converting the IdP’s “username” to uppercase, and assigning the “customer_admin” role when the value is equal to “HITACHI_TARO”

str?replace("A", "B")

Assigning a role with a name where the “hitachi” part of the name is replaced with “test” when “customer.group” in “groups” of the IdP contains the string “hitachi”

str?split("A")

Treating the first separated value as the surname when the IdP has the “name” information and the “name” value is not empty but is separated by " "

str?date("yyyy-MM-dd")

Assigning the “century_group” group when the IdP’s date of birth information (stored in yyyy-MM-dd format) is earlier than January 1, 2000

str?number

When the string-type “customer (customer code)” of the IdP is a numeric value, converting it to numeric type, and assigning the “customer_group” group if the value is greater than 2000

str?trim

Assigning the “idp_user” group when the IdP’s customer information is not empty and its value is equal to 2000

str?contains("A")

Assigning the “hitachi_group” group when the IdP’s “email” information contains the string “hitachi”

str?starts_with("A")

Assigning the “itsm_admin” role when the IdP’s “username” information starts with the string “admin”

str?ends_with("A")

Using the IdP’s “email” information as Ops I’s “email” information when the IdP’s “email” ends with the string “.com”

str?matches("A")

Assigning the customer code when the IdP’s “customer (customer code)” consists of numbers

list?seq_contains("A")

Assigning the “itsm_admin” role when one of the multiple roles held by the IdP is the “admin” role

list?join("A")

Assigning the “role with the same name in Ops I when the IdP has the “role” information

(2) Errors that occur when configuring the identity provider

When there are issues with the identity provider settings or the template definitions, errors are displayed at the following times.

[When saving the identity provider]

If there is a grammatical mistake, an error message will be displayed when saving the identity provider.
You can identify the problematic line by checking the “[Details]” provided in the error message.