RackerWilliams

<?xml version="1.0" encoding="UTF-8"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
    xmlns:xs="http://www.w3.org/2001/XMLSchema"
    xmlns:atom="http://www.w3.org/2005/Atom"
    exclude-result-prefixes="xs"
    version="2.0">
    <xsl:template match="@* | node()">
        <xsl:copy>
            <xsl:apply-templates select="@* | node()"/>
        </xsl:copy>

RackerWilliams

mapping:
 version: "RAX-1"
 rules:
 - local:
    faws:
       groups:
           multiValue: true
           value: "{Ats(http://schemas.xmlsoap.org/claims/Group)}"
    user:
       domain: "797028"

RackerWilliams

---
mapping:
  rules:
  - local:
      user:
        domain: '5821006'
        name: "{D}"
        email: "{At(http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress)}"
        roles:
          >-

RackerWilliams

Old Behavior

There was no way to tell whether or not a SAML attribute should be rendered as an array or not. For example given the flowing SAML attributes:

 <saml2:Attribute Name="faws/canAddAWSAccount">
   <saml2:AttributeValue xsi:type="xs:string">true</saml2:AttributeValue>
 

RackerWilliams

Old Behavior

Suppose that the SAML assertion did not contain roles. Then then policy:

---
mapping:
  rules:
  - local:

RackerWilliams

---
mapping:
  version: RAX-1
  rules:
  - local:                     
      user:
        domain: '1025468' # Can eventually just be {D}
        email: "{At(urn:oid:1.2.840.113549.1.9.1.1)}" # Can also be {D}         
        expire: "{Pt(/saml2p:Response/saml2:Assertion/saml2:Conditions/@NotOnOrAfter[1])}" # Ditto {D} unless you specifically want it from cond         
        name: "{D}"                

RackerWilliams

---
mapping:
  version: RAX-1
  rules:
  - local:                     
      user:
        domain: '1025468' # Can eventually just be {D}
        email: "{At(urn:oid:1.2.840.113549.1.9.1.1)}" # Can also be {D}         
        expire: "{Pt(/saml2p:Response/saml2:Assertion/saml2:Conditions/@NotOnOrAfter[1])}" # Ditto {D} unless you specifically want it from cond         
        name: "{D}"                

RackerWilliams

Saxon 9.7

COLD (First Run)

time wadl2checker -dgxlpjHbr -t 20 -S SaxonEE -E XalanC allfeeds.wadl allfeeds.checker

[parseWADL : 17 Millis]
[schematronWADL : [compile /xsl/wadl-links.xsl : 369 Millis] 6749 Millis]
[svrlHandler : [compile /xsl/svrl-handler.xsl : 11 Millis] 31 Millis]
[Check Additional SRVL Reports : [compile XVRLCheck XPath : 3 Millis] 11 Millis]
[validateWADL : [SaxonEE wadl schema compile : 71 Millis] 102 Millis]

RackerWilliams

<?xml version="1.0" encoding="UTF-8"?>
<mapping xmlns="http://docs.rackspace.com/identity/api/ext/MappingRules"
         xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
         xmlns:xs="http://www.w3.org/2001/XMLSchema"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         version="RAX-1">
   <rules>
      <rule>
        <remote>
            <attribute multiValue="true"

RackerWilliams

{
  "mapping": {
    "rules": [
      {
        "remote": [
          {
            "path": "(:\n   If the number of seconds is even, then the role should be\n   nova:admin and lbaas:admin\n\n   Otherwise the roles should be nova:observe and lbaas:observer.\n:)\nif ((xs:integer(seconds-from-time(current-time())) mod 2) = 0)\n      then ('nova:admin','lbaas:admin')\n      else ('nova:observer','lbaas:observer')\n",
            "multiValue": true
          }
        ],