// Check the group-attribute for the entry "guests"
if(mapping.groups != null && mapping.groups.contains("guests")) {
    // Return the static value "guestuser"
   return "guestuser"
} else {
    // Otherwise use the value from the Name ID
    return ATTR_NAMEID
}Handle Groups Not Sent As Multivalue Attribute

return mapping.'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'?.first() ?: "UID@example.com"

// If the attribute lastName is present transform it to uppercase,
// otherwise use an empty string
def lastName  = mapping.lastName?.first() ? mapping.lastName.first().toUpperCase() : ""

// Use an emptry String for the first name if it is not present
def firstName = mapping.firstName?.first() ?: ""

def fullName = "$firstName $lastName"

// The SLF4J-logger de.resolution.retransform.impl.transformers.groovy.GroovyTransformerScript
// is available as logger and can be used to write to the application-log.
// warn is enabled by default, so this message should be visible in the log 
if (fullName.trim().isEmpty()) { 
    logger.warn("Fullname is empty or contains only whitespace")
}
    
return fullName

"attributes": {
    "grp1": [ "true"],
	"grp2": [ "true"],
	"grp3": [ "false"]
},

def groups = []

if(mapping.grp1?.contains("true")) {
    groups.add("grp1");
}
if(mapping.grp2?.contains("true")) {
    groups.add("grp2");
}
if(mapping.grp3?.contains("true")) {
    groups.add("grp3");
}

// This logger should not be used in a production-system
logger.warn("Groups are {}", groups)

return groups

// list of keys/ values to replace group names after splitting
def trafoMap = ["20368564" : "one-group", "10096280" : "other-group"] 

// read groups attribute from SAML Response split by semicolon
def splitted = mapping.groups?.first()?.split(";") 

// keep this if you want to remove groups from the user, should there be none in the SAML response
if(splitted == null) {
    return DROP_ALL // return no values, so existing groups may be removed
}

return splitted
	.collect{trafoMap[it]} // apply transformation rules from trafoMap (search and replace)
	.findAll{it} // filter null values a.k.a. drop groups not in the trafoMap

// read groups attribute from SAML Response split by comma (or any other character that separates them)
def splitted = mapping.groups?.first()?.split(",") 

return splitted.findAll{it} // filter null values and empty strings and return

// Input your data as per the descriptions below
// Replace YourIDPGroupAttribute with your actual IdP Group Attribute
def idpGroupAttribute = "YourIDPGroupAttribute"

// Replace IdP_groupName with the group name that you need to transform
def idpGroupName = "IdP_groupName"

// Replace "replacement1" and "replacement2" with the actual group names replacements, and you can add other elements if needed
def replacements = ["replacement1", "replacement2"]

// No need to change anything in the following section
def groups = mapping.get(idpGroupAttribute)
if (groups.contains(idpGroupName)) {
    groups.remove(idpGroupName)
    groups.addAll(replacements)
} 
return groups

// Input your data as per the descriptions below
// Replace YourIDPGroupAttribute with your actual IdP Group Attribute
// The example below is the Azure AD Default groups claim
def idpGroupAttribute = "http://schemas.microsoft.com/ws/2008/06/identity/claims/groups"

// Replace IdP_groupName_1 with the group name that you want to transform into multiple other groups
def idpGroupName_1 = "my-group-1"

// Add as many groups as you want to be assigned to the user, if idpGroupName_1 is present
def idpGroupName_1_transform_to_groups = ["your-group-1", "your-group-2"]

// No need to change anything in the following block, this takes
def groups = mapping.get(idpGroupAttribute)
if (groups.contains(idpGroupName_1)) {
    groups.remove(idpGroupName_1)
    groups.addAll(idpGroupName_1_transform_to_groups)
} 

// Add more 1:1 replacements here
def idpGroupName_2 = "transform-me-1"
def idpGroupNameReplacement_2 = "your-group-3"

if (groups.contains(idpGroupName_2)) {
    groups.remove(idpGroupName_2)
    groups.add(idpGroupNameReplacement_2)
} 


def idpGroupName_3 = "transform-me-2"
def idpGroupNameReplacement_3 = "your-group-4"


if (groups.contains(idpGroupName_3)) {
    groups.remove(idpGroupName_3)
    groups.add(idpGroupNameReplacement_3)
} 

return groups

// Check the email-attribute and if it is not empty check if it contains the email domain
if (mapping.email[0] != null) {
	if (mapping.email[0].contains("@lab.resolution.de")) {
    	// if it contains the domain return the NameID
    	return mapping.ATTR_NAMEID
	} else {
    	// Otherwise drop the authentication
    	return DROP_ALL
	}
} else {
    // if email-attribute and if it is empty log a warning message and drop the authentication
	logger.warn("Dropping User authentication due to missing SAML attribute email")
	return DROP_ALL
}

def groupsToReturn = (groups != null && groups != DROP) ? groups : []
//Check ATTR_SD_CUSTOMER attribute is false and if user is in group g1, when both conditions are met add the user to the group jira-servicedesk-users
if(ATTR_SD_CUSTOMER != ["true"]) {
    logger.warn("SD Portal is NOT called")
    if(groupsToReturn.contains("g1")) {
        logger.warn("User is in g1")
        groupsToReturn.add("jira-servicedesk-users")       
    } else {
		//If the user is not in group g1 
        logger.warn("User is not in g1")
    }
//If user has called the JSM portal    
} else {
	//If user has called the JSM portal    
	logger.warn("SD Portal is called")
}
return groupsToReturn

String email = mapping.email?.first()
String username = mapping.ATTR_NAMEID?.first()

// Check if there is already a user with this email in the system
def existingUser = findUser("ATTR_EMAIL",email)
if(existingUser == null) {
    return email
} else {
    // If there is such a user check if it's the same username
    if(username == existingUser.get("ATTR_NAME").first()) {
        return email
    } else {
        // if not drop the user
        return DROP_USER
    }
}

// Enter the list of usernames not to be reactivated below:
def usernameBlacklist = ["username1","username2","username3"]
// 

String username = mapping.ATTR_NAMEID
if (username in usernameBlacklist) {
    def user = findUser("ATTR_NAME",username)
    def active = user?.ATTR_ACTIVE
    if (active?.getAt(0) == "true") {
        return username
    } else {
        return DROP_ALL
        }
} else { 
    return username 
}

// Enter here the list of values that would be checked against:
allowedList = ["value1", "value2", "value3", "value4"]
//

String user = mapping.ATTR_NAMEID?.getAt(0)
def dep = mapping.userDep

if (dep.any { allowedList.contains( it ) }) {
    return user
} else {
    return DROP_ALL
}

"loginInformation" : {
	"nameId" : "M1234",
	"attributes" : {
		"ATTR_NAMEID" : [ "M1234" ],
		"groups" : [ "group1", "group2" ],
		"email" : [ "john.doe@example.com" ],
        "fullname" : [ "John Doe" ],
		"department" : [ "IT" ]
      }
    }

username = mapping.ATTR_NAMEID
dept = mapping.department
grp = mapping.groups

if (dept?.getAt(0) == "IT" && username.any {it ==~ /M\d+/} ) {
    grp.addAll("myGroup")
}

return grp

def existingGroups = existing?.ATTR_GROUPS ?: []

def groupsToReturn = []

groupsToReturn.addAll(existingGroups)

if(mapping?.<your-attribute>?.first() == "Internal") {
    groupsToReturn.add("jira-users")
    }
else {
    groupsToReturn.add("jira-external-users")
    }

return groupsToReturn.toUnique()

def existingGroups = existing?.ATTR_GROUPS ?: []
def groupsToReturn = []

groupsToReturn.addAll(existingGroups)

// Check <your-attribute> and if it is not null check if it contains Internal
// Assign group jira-empty, if it is null.
// Assign group jira-users, if it is not null but does contain Internal
// Assign group jira-external-users, if it is not null but does not contain Internal

if (mapping.<your-attribute> == null) 
{
    groupsToReturn.add("jira-empty")
}  

else if (mapping.<your-attribute>.first() == "Internal") 
{
    groupsToReturn.add("jira-users")
} 

else 
{
    groupsToReturn.add("jira-external-users")
}

return groupsToReturn.toUnique()

"loginInformation" : {
	"nameId" : "M1234",
	"attributes" : {
		"ATTR_NAMEID" : [ "M1234" ],
		"email" : [ "john.doe@example.com" ],
        "fullname" : [ "John Doe" ],
		"WorkerType" : [ "Internal" ]
      }
    }

// Groups to never remove (can be overriden below)
def groupsToKeep = [ /jira-.*/ ]

// Groups in this list are filtered out
def groupBlacklist = [ /\[TBD.*/ ]

// Groups not in this list are filtered out
def groupWhitelist = [ /\[TBD\].*/, "jira-users", "jira-external-users" ]

def existingGroups = existing?.ATTR_GROUPS?.asStringList() ?: []
def connectorGroups =  con?.GROUPS?.asStringList() ?: []

def groupsToReturn = []

def existingGroupsToKeep = existingGroups.findAll {
    egroup -> groupsToKeep.any {keep -> egroup ==~ keep } }

groupsToReturn.addAll(existingGroupsToKeep)

// Every group-pattern in the blacklist must NOT match a group's name

def groupsAfterBlacklist = connectorGroups.findAll {
    cgroup -> groupBlacklist.every {bl -> !(cgroup ==~ bl) } }

// Any matching group-pattern in the whitelist is sufficient 
// be aware that the blacklisted groups are filtered out already,
// so the blacklist has higher precedence than the whitelist.

def groupsAfterWhitelist = groupsAfterBlacklist.findAll {
    cgroup -> groupWhitelist.any {wl ->   cgroup ==~ wl  } }

groupsToReturn.addAll(groupsAfterWhitelist)

String workerType = saml.'WorkerType'?.first()?.asString()

// When saml is not empty, this
// is a single user update during saml login
boolean isLogin = !saml?.isEmpty()

if(isLogin) {
    if(workerType ==~ /^Internal.*/ ) {
        groupsToReturn.add("jira-users")
        groupsToReturn.remove("jira-external-users") }
    else if(workerType ==~ /^E[ABC].*/) {
        groupsToReturn.add("jira-external-users")
        groupsToReturn.remove("jira-users")
    }
}

return groupsToReturn.toUnique()

def groups = existing?.ATTR_GROUPS ?: []
groups.addAll(con?.GROUPS ?: [])

// Check if the account is disabled and the user is part of the group confluence-users
if (con.accountEnabled == "false" && groups.contains("confluence-users")) { 
// If the criterias match remove the user from the group confluence-users
groups.remove("confluence-users")
}

return groups.toUnique()

// collect{} applies the given closure to all
// elements in a list and returns a list containing 
// all the transformed elements. 
// Using safe-dereference ?. to avoid a NullPointerException if GROUPS is not present
return con.GROUPS?.collect{
    grp -> grp.toString()                 // toString() is required because the elements are StringStructuredData
        .replaceAll(/Pink Floyd/,'def')   // using Slashy Strings for the regex avoids some escaping 
        .replaceAll(/Blind(.*)/,'xyz$1')  // using '' instead of "" for the replacements allows using $ without escaping 
        .replaceAll(/\./,'%')             // replacing . requires escaping (\.), in a normal String this would be \\., but not required in Slashy Strings
        // add more as needed
    } ?: []                               // return an empty list of the GROUP-attribute is not present

{
  "con": {
    "USERID": "damaris.rau",
    "Unique_ID": "b9e13bcc-3df9-4eaf-ab8c-c8e77485d484",
    "EMAIL": "damaris.rau@example.org",
    "FULLNAME": "Damaris Rau",
    "Manager": "zane.maggio",
    "GROUPS": [
      "Pink Floyd",
      "Blind Faith",
      "R.E.M."
    ]
  },
  "saml": {},
  "existing": {}
}

["def","xyz Faith","R%E%M%"]

// Replace the <> placeholder with the group name below
def exclusionGroup = "<enter the group name here>"

if (con.GROUPS.contains(exclusionGroup)) {
    return DROP_ALL
}

return GROUPS

// default groups to assign under specific criteria
// change the group names as per your requirement
def defaultGroups = ["jira-users", "confluence-users" ]

// mapping the IdP groups
def connectorGroups =  con?.GROUPS?.asStringList() ?: []

// mapping the email address
// change userPrincipalName below to your email attribute
def email = con?.userPrincipalName?.first() ?: []

// check if the email address has a specific domain
// change example below to your actual domain
if (email ==~ /.*@example\.com/) {
    // if true, add the default groups to the list of groups returned by the IdP
    connectorGroups.addAll(defaultGroups)
}

return connectorGroups

// mapping the IdP groups
def connectorGroups =  con?.GROUPS?.asStringList() ?: []

// When saml is not empty, this
// is a single user update during SAML SSO login
boolean isLogin = !saml?.isEmpty()

if (isLogin) {
    connectorGroups.addAll("groupA")
}
return connectorGroups

// default group to assign under specific criteria
def defaultGroup = "jira-software-users"

// required groups for the condition
def requiredGroups = ["requiredGroup1", "requiredGroup2", "requiredGroup3"]

// mapping the IdP groups
def connectorGroups =  con?.GROUPS?.asStringList() ?: []

// if the user is a member of any of the requiredGroups, add the defaultGroup
if (connectorGroups.any { requiredGroups.contains( it ) }) {
    connectorGroups.addAll(defaultGroup)
}

return connectorGroups