manipulating attributes
Replacing strings in attributes
Our attribute syntax can replace strings. This syntax is part of our attribute matching (fylr 6.20 and newer):
%(key||search||replacement)sWhere search is the regexp matching what is then replaced with replacement.
The regular expressions syntax rules: https://pkg.go.dev/regexp#Regexp.ReplaceAllString.
Example: %(email||^.*=||)s, in context:
When a user logs in with attribute email equal to urn:campus:1:mail=ben@example.com and attribute mapping Target:Email %(email||^.*=||)s then his email address in fylr will be just ben@example.com, because the search part matches all up to the equal sign and the replacement is empty.

Multi-Value-Attributes
If there are multiple values for e.g. department, a 4th parameter can now be used to concatenate multiple values into one.
Example: %(dpmt||^.*=||||;)s, in context:
When a user logs in with these two attributes urn:campus:1:dpmt=marketing and urn:campus:2:dpmt=sales , the attribute mapping is done like above and in fylr the department will be
marketing;sales
pick first attribute
If an attribute is replaced like this %(mail|email)s, fylr now uses the first entry which is not empty as replacement.
Using JavaScript
You can edit incoming data from SAML via JavaScript in the following field:

Each user is processed separately and is stored in the JavaScript object entry with string arrays as values. Changes configured in this field are done before the IDP data is mapped to the fylr user.
Complex example
Requirements for the JavaScript in this example scenario:
If the user has an attribute
officialEmail, use that as the user's email address in fylr.Otherwise use the attribute
email(private email address) in fylr, but only if the user is an employee, never if it is a student.Employees but not students have
urn:employeesomewhere in theirentitlementattribute.
JavaScript that solves these requirements:
tested in fylr
requires the following User Mapping in fylr:

Debugging JavaScript
JavaScript is executed in "Strict Mode".
Thus attributes cannot be overwritten.
After a SAML account tried to login, look into https://yourfylr.example.com/inspect/system/console/ (login as fylr account "root"). Example output there after successful first login:
The first indented block is before JavaScript.
The first indented block is after JavaScript.
The rest of the lines is the result of the login and mapping process. This was the first time a user with
myref=case3has logged in.myrefis mapped toReferenceand Referenz (same a s Reference) is used forUser Update.The value of the attribute
officialEmailwas used in fylr.
Last updated