--- version: "1.50" language: "en" --- # Attribute Functions ## Definition Attribute Functions allow you to evaluate and manipulate attributes to be sent to applications through a Federation. Attribute Functions reference built-in functions and are declared in the Memority ADM portal. Attribute Functions can then be used in a Federation configuration in the USR portal. ## Built-in Attribute Functions The following built-in functions are available : | **Name** | **Input** | **Output** | **Description** | **Example** | |--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------| | valueOf() | Takes the attribute name as argument. | `String` | Returns the value of an attribute name. | `valueOf(firstName)` | | concat() | Takes a variable number of either : * attribute name * or string literals | `String` | Concatenate the passed arguments as a String. Only mono-valued attributes can be used with this function. Multi-valued attributes are not supported. | `concat(firstName, " ", lastName)` | | contains() | Takes 2 arguments : * the attribute name * the value to be filtered | `String` | Return filtered value(s) of the given attribute. Value used in argument is case sensitive | `contains(email, "memority.com")` | | convertToBoolean() | Takes the attribute name or a function as argument. | `Boolean` | Convert returned value from String to boolean (e.g `true` instead of "true") | `convertToBoolean(isVIP)` | | convertToInteger() | Takes the attribute name or a function as argument. | `Integer` | Convert returned value from String to integer (e.g `0` instead of "0") | `convertToInteger(employeeNumber)` | | convertToJson() | Takes the attribute name or a function as argument. | `JSON Object` | Convert returned value from String to JSON Object | `convertToJson(rights)` | | hasRight() | Can take as arguments (using attribute names or string literals): * only the right name * the right name and the target * or the right name, the target and the privilege | `Boolean` | Test whether the processed Identity has been granted a certain right. When used to provide a claim value, it returns "true" or "false". | `hasRight("app.o365")` `hasRight("admin", "app.o365`) `hasRight("admin", "app.o365", "write")` | | rightTargets() | Only takes the right name as argument (can be an attribute name or a string literal). | `String` | Retrieve the targets of a granted right. | `rightTargets("admin")` | | rightPrivileges() | Takes 2 arguments (can be attribute names or string literals): * the right name * and the target | `String` | Retrieve the privileges of a granted right on a certain target. | `rightPrivileges("admin", "app.o365")` | | valueIfAuthLevel() | Takes 2 arguments : * the attribute name * the authentication level * the comparison operator The authentication level is provided as a string. | `String` | Returns the value of the specified attribute only if the user's authentication level matches the given level according to the comparison operator ("EQ", "INF_OR_EQ", "INF", "SUP", "SUP_OR_EQ", "NOT_EQ"). If no comparison operator is specified, "SUP_OR_EQ" is used by default. | `valueIfAuthLevel(birthDate, "100"`) `valueIfAuthLevel(birthDate, "100", "EQ"`) | | valueIfRight() | Can take as arguments (using attribute names or string literals): * the attribute name and the right name * the attribute name, the right name and the target * or the attribute name, the right name, the target and the privilege | `String` | Returns the value of the given attribute if the current user has : * the given right * or the given right on the target * or the privilege of the given right on a the target | `valueIfRight(o365profile, "admin")` `valueIfRight(o365profile, "admin", "app.o365")` `valueIfRight(o365profile, "admin", "app.o365","write")` | ## Usage Attribute Functions can only be used in a Federation configuration. It can be applied to Name Id or Attributes in the Federation by selecting "Function" as type in the drop-down icon. ![image-20240910-072114.png](https://doc.memority.eu/__attachments/a_0cb0b9c89796a30691b27d86b9f1dc355a331a8166cdcb3b6ba0bc0993a46af3/image-20240910-072114.png?cb=fb6d5b0e58693bf28f2b96b0249a10b3) Then you can select the desired Attribute Function (among those configured for the tenant) in the Function list. ![image-20240910-072304.png](https://doc.memority.eu/__attachments/a_e3acbf9dca77e1dbad4f2f1cf811767423ed0d97e50e2bb2d35fc80aa857b46b/image-20240910-072304.png?cb=1b1e487b97b5d8c70bd9689c78bb53e6) The Attribute Function may requires some parameters you need to fill. ![image-20240910-072435.png](https://doc.memority.eu/__attachments/a_df1ba6ed96a5c1295bbf4036bd7fa6ae48e03fc28813802cff913ed0a33ae2d8/image-20240910-072435.png?cb=53551cc95b5196c1845ae13007c1d543) Note that only configurable arguments are displayed but some fixed arguments may be hidden. So make sure to use the suitable Attribute Function. ## Configuration 🎯 You can access the Attribute Functions configuration : * by clicking on "**Access** " → "**Attribute Functions**" * by clicking on "**System** " → "**Configurations** " → "**Access Service**" and perform an import/export. ### Properties The main configuration elements are : | **Property name** | **Type** | **Mandatory** | **Description** | **Values (default value in bold)** | **Modifiable after creation** | |-------------------|-----------------------------------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------| | id | `String` | YES | The Attribute Function identifier. This identifier will be displayed in Function list in the Federation configuration screen. | - | NO | | name | `String` | YES | The Attribute Function name. | - | YES | | description | `String` | NO | The Attribute Function description. | - | YES | | arguments | `List` | YES | The list of input arguments for the Attribute Function. Two possible argument types : * `FixedAttributeFunctionArgumentType` to impose the input argument so it cannot be modified when using this Attribute Function in a Federation * `VariableAttributeFunctionArgumentType` to let free choice about the input argument when using this Attribute Function in a Federation | - | NO (except for unused Attribute Functions) | | builtinFunction | `String` | YES | The name of the built-in function to use | See [Built-in Attribute Functions](https://doc.memority.eu/configuration-guide/latest/attribute-functions#Built-in-Attribute-Functions) | NO (except for unused Attribute Functions) | | legacy | `Boolean` | YES | Indicates if the Attribute Function is legacy . Built-in functions listed in this documentation are NOT legacy. | true, **false** | NO | #### argument properties - Fixed | **Property name** | **Type** | **Mandatory** | **Description** | **Values (default value in bold)** | **Modifiable after creation** | |-------------------|--------------------------------------------------------------|---------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------|--------------------------------------------| | value | `IdentityAttributeValueType` or `ConstantAttributeValueType` | YES | Two possible types : * `IdentityAttributeValueType` : define the User Attribute to use as argument * `ConstantAttributeValueType` : define the value (string literals) to use as argument | `-` | NO (except for unused Attribute Functions) | ## Example XML Test Function firstName concat false ## Reporting You can see all applications using a specific Attribute Function in Reports, by using the [Federation Mongo collection](https://doc.memority.eu/configuration-guide/latest/reporting-object-configurations.md#FEDERATION). It can help if you want to delete an Attribute Function still in use in one or more Federations. ## Read Next * [Federation Widget](https://doc.memority.eu/configuration-guide/latest/federation-widget.md) Allows to manage or display the Federation corresponding to an application Resource. * [Federation Logs Widget](https://doc.memority.eu/configuration-guide/latest/federation-logs-widget.md) The Federation Logs Widget allows to view logs related to a Federation.