Using OGNL expressions to call a custom Java class to extend PingFederate

Object-Graph Navigation Language (OGNL) is based on the Java Programming language and is part of the Apache Commons library. It has been integrated in to PingFederate and is extremely useful for evaluating and manipulating attribute values as part of attribute contract fulfillment within a SAML or WS-Federation connection or used as part of Issuance Criteria. The real power comes when extending OGNL with a java class for implementing complex business requirements that are more advanced than what OGNL can handle. This blog covers the process to extend OGNL expressions by writing a custom java method that can be invoked as an OGNL method within PingFederate.

The use case that we run into most commonly is when an attribute returned from a data source (e.g. Active Directory, LDAP, or JDBC) needs further processing as part of attribute contract fulfillment. For example, parsing the Active Directory attribute memberOf. By default, the attribute returned from active directory will contain the distinguished names for every security group, however, you may only want the common names to be returned in the assertion. This is accomplished through the following steps:

The following is a simple method for parsing the CN value for all the security groups returned by the Active Directory memberOf attribute.

package com.pegright.ping;
public class UtilParseMemberOf {
    public String parseGroups(String groupString) {
        StringBuilder outStr = new StringBuilder();
        outStr.append("[");
        boolean first = true;
        String[] items = groupString.split("CN=");
        for(String s : items){
            if(s.indexOf(",") >0) {
                String group = s.substring(0,s.indexOf(","));
                if(first) {
                    first = false;
                } else {
                    outStr.append(", ");
                }
                outStr.append("""+group+""");
            }
        }
        outStr.append("]");
        return outStr.toString();
    }
}

This OGNL expression can be used to fulfill an SP Connection attribute, whether the connection is for SAML or WS-Federation. Within the attribute contract fulfillment, the source type of Expression allows for OGNL expressions to be used for complex mapping capabilities. The following is a sample expression that utilizes the Java library:

#ptp = new com.pegright.ping.UtilParseMemberOf(),
#result = ptp.parseGroups(#this.get("ds.memberOf"))

The use of OGNL by PingFederate is a great way to implement complex mapping requirements to fulfill attribute contracts. The ability to extend OGNL by writing your own custom Java class for unique requirements further shows the flexibility of PingFederate. It’s one of the key capabilities that makes PingFederate the market leader in meeting complex federation use cases. Contact us if you have questions on the use of OGNL or if you need help making the most of your Ping Identity investment.