test.yaml

---
mapping:
  version: RAX-1
  rules:
  - local:                     
      user:
        domain: '1025468' # Can eventually just be {D}
        email: "{At(urn:oid:1.2.840.113549.1.9.1.1)}" # Can also be {D}         
        expire: "{Pt(/saml2p:Response/saml2:Assertion/saml2:Conditions/@NotOnOrAfter[1])}" # Ditto {D} unless you specifically want it from cond         
        name: "{D}"                
        roles:
        - foo bar biz
        - baz
        - |
          {Pts(
             let $groups := mapping:get-attributes('http://schemas.xmlsoap.org/claims/Group')
             return (
                  if ($groups='aws.rackspace.admin')     then ('billing:admin', 'ticketing:admin','admin') else (),
                  if ($groups='aws.rackspace.billing')   then 'billing:admin' else (),
                  if ($groups='aws.rackspace.ticketing') then 'ticketing:admin' else ()
                 )
          )}
      faws:
        groups:
          multiValue: true
          value: "{Ats(http://schemas.xmlsoap.org/claims/Group)}"