x500NameOneAndOnly Function Description

Description

This function takes in a bag of attributes of type x500Name and returns a single value. It only works if the bag contains a single value. If the bag contains zero values or more than 1 value than the function will trigger an error yielding Indeterminate. Use this function when you need to compare an attribute to a single value. See example below.

x500NameOneAndOnly belongs to the ALFA function reference's Bag functions category. It maps to the XACML function identifier urn:oasis:names:tc:xacml:1.0:function:x500Name-one-and-only, takes 1 argument and returns a value of type x500Name.

Property Value
Category Bag functions
# Arguments 1
Arguments
  • A bag of attribute values of type x500Name.
Return Value x500Name
Expressed As pre-fix
Representation ALFA short name
Allowed In Target false
ALFA Shorthand None
Commutative false

Example

/**
 * Check a user's LDAP entry.
 */
rule x500NameOneAndOnlyExample{
    permit
    condition x500NameOneAndOnly(rdn)=="CN=Steve Kille,O=Isode Limited,C=GB":x500Name
}

In this example, access is permitted if the user looked up (presumably in an LDAP-like system) is Steve Kille.

See Also

Related Functions

Other functions in the Bag functions category:

Browse the full ALFA function reference.