On 2018-03-22 03:34, ScorpionSting wrote:
> What I do need with this connector, is the ability to use IdT.
> I can have a loopback fudge DirXML-Accounts data for the IdT connector,
> but the Sentinel connector needs to supply the 3 required fields
> (tenant, username, userdomain).....
> At the moment, only tenant and username
> ({repository-name}\\{User-name-attributes}) are populated. The username
> could be split and the {repository-name} goes into userdomain and the
> {user-name-attributes} goes into username, this would then satisfy the
> IdT requirements. I guess the only regex complexity will be where the
> AAF tenant is parsed through (if it is), then userdomain should be
> {aaf-tenant}\\{respository-name}

IIRC, if there is no domain in the identity data it actually creates a
field with value " " in the database (since the domain/authority is non
null) and then creates the csv file with the same " " in the domain field.

So you can't match on events with empty userdomains. Please file an SR
to have the collector parse out userdomain as you described.

I once had a similar problem with the BlueCoat collector. The raw data
has nothing that resembles a userdomain. So I added a custom.js that set
all UserDomain* fields to a default value if the respective UserName
field was not emtpy.