Sample Shibboleth attribute resolver for REFEDS RAF IAP and eduPersonAssurance via Grouper group membership

attribute-resolver-snippet.xml

    <!-- Custom attribute assertion values for REFEDS IAP eduPersonAssurance -->
    <AttributeDefinition xsi:type="Mapped" id="eduPersonAssurance">
        <InputDataConnector ref="myLDAP" attributeNames="memberOf" />
        <InputDataConnector ref="grouper_db_idp" attributeNames="grouper_idp_groups" />
        <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" friendlyName="eduPersonAssurance"/>
        <ValueMap>
            <ReturnValue>https://refeds.org/assurance/IAP/high</ReturnValue>
            <SourceValue>ref:assurance:nu:IAP:high</SourceValue>
        </ValueMap>
        <ValueMap>
            <ReturnValue>https://refeds.org/assurance/IAP/medium</ReturnValue>
            <SourceValue>ref:assurance:nu:IAP:medium</SourceValue>
        </ValueMap>
        <ValueMap>
            <ReturnValue>https://refeds.org/assurance/IAP/low</ReturnValue>
            <SourceValue>ref:assurance:nu:IAP:low</SourceValue>
        </ValueMap>
        <ValueMap>
            <ReturnValue>https://refeds.org/assurance/IAP/local-enterprise</ReturnValue>
            <SourceValue>ref:assurance:nu:IAP:local_enterprise</SourceValue>
        </ValueMap>
        <ValueMap>
            <ReturnValue>https://refeds.org/assurance</ReturnValue>
            <SourceValue>ref:assurance:nu:IAP:(low|medium|high|local_enterprise)</SourceValue>
        </ValueMap>
    </AttributeDefinition>

    <!-- Grouper connection to release groups only to the SP being authenticated into -->
    <DataConnector id="grouper_db_sp" xsi:type="RelationalDatabase">
        <InputAttributeDefinition ref="unNUID" />
        <BeanManagedConnection>shibboleth.OracleDataSource</BeanManagedConnection>
        <QueryTemplate>
            <![CDATA[
            SELECT
                    CASE WHEN B.VALUE_STRING IS NULL THEN A.GROUP_NAME ELSE B.VALUE_STRING END AS "GROUP_NAME"
                FROM
                    (
                    SELECT
                        DISTINCT grouper_memberships_lw_v.group_name,
                        grouper_aval_asn_group_v.GROUP_DISPLAY_NAME
                    FROM
                        es_grouper.grouper_aval_asn_group_v
                    JOIN es_grouper.grouper_memberships_lw_v
                            USING (GROUP_ID)
                    WHERE
                        subject_id = '$unNUID.get(0)'
                        AND list_name = 'members'
                        AND grouper_aval_asn_group_v.attribute_def_name_name = 'etc:attribute:nebraska:saml2EntityId'
                        AND (value_string = '$resolutionContext.getAttributeRecipientID()'
                        OR value_string = 'DEFAULT')
                        AND grouper_aval_asn_group_v.enabled = 'T'
                    ORDER BY
                        group_name ASC) A
                LEFT OUTER JOIN es_grouper.grouper_aval_asn_group_v B ON
                    A.GROUP_DISPLAY_NAME = B.GROUP_DISPLAY_NAME AND
                    B.attribute_def_name_name = 'etc:attribute:nebraska:saml2EntityDisplayName'
            ]]>
        </QueryTemplate>

        <Column columnName="GROUP_NAME" attributeID="grouper_sp_groups" />
    </DataConnector>

    <!--
        Grouper connection for groups released to a desginated IdP, not on a
        SP by SP basis
    -->
    <DataConnector id="grouper_db_idp" xsi:type="RelationalDatabase">
        <InputAttributeDefinition ref="unNUID" />
        <BeanManagedConnection>shibboleth.OracleDataSource</BeanManagedConnection>
        <QueryTemplate>
            <![CDATA[
            SELECT
                CASE
                        WHEN B.VALUE_STRING IS NULL THEN A.GROUP_NAME
                        ELSE B.VALUE_STRING
                END AS "GROUP_NAME"
            FROM
                (
                SELECT
                    DISTINCT grouper_memberships_lw_v.group_name,
                    grouper_aval_asn_group_v.GROUP_DISPLAY_NAME
                FROM
                    es_grouper.grouper_aval_asn_group_v
                JOIN es_grouper.grouper_memberships_lw_v
                        USING (GROUP_ID)
                WHERE
                    subject_id = '$unNUID.get(0)'
                    AND list_name = 'members'
                    AND grouper_aval_asn_group_v.attribute_def_name_name = 'etc:attribute:nebraska:saml2IdPEntityId'
                    AND (value_string = '%{idp.entityID}'
                    OR value_string = 'DEFAULT')
                    AND grouper_aval_asn_group_v.enabled = 'T'
                ORDER BY
                    group_name ASC) A
            LEFT OUTER JOIN es_grouper.grouper_aval_asn_group_v B ON
                A.GROUP_DISPLAY_NAME = B.GROUP_DISPLAY_NAME
                AND B.attribute_def_name_name = 'etc:attribute:nebraska:saml2EntityDisplayName'
            ]]>
        </QueryTemplate>
        
        <Column columnName="GROUP_NAME" attributeID="grouper_idp_groups" />
    </DataConnector>