You can use conditions in a rule to check input claims and determine if the issuance statement of the rule should be executed. Conditions are optional in rules. For example, this rule does not have a condition.

=> issue(type = "http://test/role", value = "employee");

Typical conditions, such as the conditions that are described in the following table, are constructed to simply check for a claim with a specified claim type or for a claim with a specified claim type and claim value.

c:[type == "http://test/name"] 
   => issue(claim = c);

c:[type == "http://test/name", value == "Terry"] 
   => issue(claim = c);

More complex conditions are possible, including conditions to check for multiple claims, conditions to check the issuer of a claim, and conditions to check for values that match a regular expression pattern.

The issuance statement of a rule defines what claims will be issued by the rule when the conditions are matched. Issuance statements may issue claims by using literal values in the rule, values from claims that match the conditions, and attribute stores. The following table describes some common syntax constructions for issuance statements in claim rules.

c:[type == "http://test/employee", value == "true"] 
   => issue(type = "http://test/role", value = "employee");

c:[type == "http://test/group"] 
   => issue(type = "http://test/role", value = c.Value);

c:[Type == "http://test/name"]

   => issue(store = "Enterprise AD Attribute Store",

         types = ("http://test/email"),

         query = ";mail;{0}",

         param = c.Value)

c:[type == "http://test/name"]

   => issue(store = "Custom SQL store", 

         types = ("http://test/email","http://test/displayname"), 

         query = "SELECT mail, displayname FROM users WHERE name='{0}'",

         param = c.value);

A rule statement consists of a condition, an imply operator, and a rule body. Rules are separated from each other with semicolons.

Condition

Rule body

Claim issuance actions

Expressions are used on the right side for both claims selector constraints and issuance statement parameters. There are various kinds of expressions that the language supports. All expressions in the language are string based, which means that they take strings as input and produce strings. Numbers or other data types, such as date/time, in expressions are not supported. The following are the types of expressions that are supported by the language:

• String literal: String value, delimited by the quote (“) character on both sides.
  
  
• String concatenation of expressions: The result is a string that is produced by concatenation of the left and right values.
  
  
• Function call: The function is identified by an identifier, and the parameters are passed as a comma-delimited list of expressions enclosed in brackets (“()”).
  
  
• Claim’s property access in the form of a variable name DOT property name: The result of the value of the identified claim’s property for a given variable valuation. The variable must first be bound to a claims selector before it can be used in this way. It is illegal to use the variable that is bound to a claims selector inside the constraints for that same claims selector.
  
  

The following claim properties are available for access:

• Claim.Type
  
  
• Claim.Value
  
  
• Claim.Issuer
  
  
• Claim.OriginalIssuer
  
  
• Claim.ValueType
  
  
• Claim.Properties[property_name] (This property returns an empty string if the property_name cannot be found in the claim’s properties collection.)
  
  

You can use the RegexReplace function to call inside an expression. This function takes an input expression and matches it with the given pattern. If the pattern matches, the output of the match is replaced with the replacement value.

Aggregate functions are used to implement scenarios in which you need to take the set of claims that a claim selector produces and aggregate them into a single value. In the issuance language, the single value that aggregate functions produce is always a number. If the returned number is greater than “0”, the condition is evaluated as logical true and the rule’s body is executed.

The aggregate function “exists” evaluates to “1” if there is at least one claim that is matched by the claim selector argument. It evaluates to “0” if the result from the claim selector is empty. The “origin” claim is issued exactly once, if there is at least one claim in the input claim set collection that has the issuer set to “MSFT”, no matter how many claims have the issuer set to “MSFT”.

exists([issuer == "MSFT"])
   => issue(type = "origin", value = "Microsoft");