If the attribute already exists, the values added will be merged into a multi-valued attribute.

If you instead want to replace the existing attribute, you may add the `'%replace'` option.

Examples

: The attribute in which the search is performed.

This parameter is REQUIRED and the filter will throw an exception if it is not set. The filter will

stop quietly if the attribute specified here is empty or not found.

: The pattern to look for inside the subject. Supports full Perl Compatible Regular Expressions (PCRE).

This parameter is REQUIRED and the filter will throw an exception if it is not set.

: The value used to replace the match. Back references are not supported.

This parameter is REQUIRED, except when using the `%replace` or `%remove` options. If `%replace` is used and

`replacement` is not set, then the match is used as a replacement.

: The attribute where the replaced value will be placed.

This parameter is OPTIONAL, and if not set, `subject` is used as `target`.

: Indicates whether the altered values must be merged with the target attribute values. The default

behaviour is to overwrite the target attribute completely.

This parameter is OPTIONAL.

Examples

'pattern' => '/(?:[A-Za-z0-9-]+\.)+[A-Za-z]{2,6}$/',

'replacement' => 'newdomain.com',

],

Set the eduPersonPrimaryAffiliation based on users' distinguishedName:

10 => [

'replacement' => 'staff',

'target' => 'eduPersonPrimaryAffiliation',

],

Normalize the eduPersonPrimaryAffiliation:

10 => [

'replacement' => 'student',

'%replace',

],

Get the domain of the emailaddress and put it in a separate attribute:

10 => [

'target' => 'myAttribute',

'%replace',

],

Remove internal, private values from eduPersonEntitlement:

10 => [

Filter that copies attributes.

Examples

]

],

],

Only allow specific values for an attribute that match a regex pattern

'authproc' => [

]

],

],

Don't allow any attributes by default, but allow the metadata to override it.

'authproc' => [

Filter that creates a target attribute based on one or more value(s) in source attribute.

Besides the mapping of source values to target values, the filter has the following options:

* `%replace` can be used to replace all existing values in target with new ones (any existing values will be lost)

* `%keep` can be used to keep the source attribute, otherwise it will be removed.

Will add eduPersonAffiliation containing value "`student`" if the `memberOf` attribute contains

either '`cn=student,o=some,o=organization,dc=org`' or '`cn=student,o=other,o=organization,dc=org`'.

The '`memberOf`' attribute will be removed (use `%keep`, to keep it) and existing values in

],

],

Add `student`, `employee` and `both` affiliation based on LDAP groupmembership in the `memberOf` attribute.

'authproc' => [

],

],

Replace any existing '`affiliation`' attribute values and keep the '`groups`' attribute.

'authproc' => [

50 => [

'class' => 'core:AttributeValueMap',

51 => [

'class' => 'core:CardinalitySingle',

'flatten' => ['eduPersonAffiliationWithCommas'],

],

],

* `eduPersonAffiliation-example.org-student`

* `eduPersonAffiliation-example.org-member`

Examples

'someOtherAttribute',

],

],

The name of the attribute can be changed from the default by adding the `attributename` option.

Examples

It must be `'core:PHP'`.

* `$attributes`.

This is an associative array of attributes, and can be modified to add or remove attributes.

* `$state`.

This is an associative array of request state. It can be modified to adjust data related to the authentication

such as desired NameId, requested Attributes, authnContextRef and many more.

',

],

Create a random number variable:

10 => [