<commit_before>= Expression Language
:page-sidebar: am_3_x_sidebar
:page-permalink: am/current/am_userguide_expression_language.html
:page-folder: am/user-guide
:page-layout: am

== Overview

The AM Expression Language (EL for short) is one of the key features that can be used to configure various aspects of an AM domain.

=== Usage

The basic expression language syntax is as follows:

[code]
----
{#request.method}

{#context.attributes['user']}
----

See the sections below for example expression notations.

=== Information available through the Expression Language

To use the EL, it is important to know which information are available. In this section you can find a summary of what is available through the AL on AM.

NOTE: This page contains the most used elements, for some specific EL there are other information available. To be aware of these information, you can refer to the UI documentation by clicking on the information icon (the letter "i" into a circle) available into the EL field description.

==== Request information

It is sometime useful to access to the request information through the EL. As an example, you may want to check the presence of a scope in the authorization request to enforce MFA (`{#request.params['scope'][0] == 'write'}`)

.`Request` information
[cols="1,2,2"]
|===
|Attribute |Description |Syntax

| headers
| Headers of the HTTP request (MultiValueMap)
| {#request.headers['MyHeaderName'][0]}

| params
| Query parameters of the HTTP request (MultiValueMap)
| {#request.params['MyParam'][0]}

| scheme
| Scheme of the request (http, https)
| {#request.scheme}

| method
| Method of the request (POST, GET, ...)
| {#request.method}

| path
| Path of the request
| {#request.path}

| paths
| Array of string that contains each path element
| {#request.paths[0]}

|===

==== Application information

You can access to the client/app properties using this EL `{#context.attributes['client']}`.
This expression will return a ClientProperties object with following attributes:

.`Application` information
[cols="1,2,2"]
|===
|Attribute |Description |Syntax

| id
| Client/App Internal identifier
| {#context.attributes['client']['id']}

| domain
| Domain Internal identifier on which the application is attached
| {#context.attributes['client']['domain']}

| clientId
| The client_id of the application
| {#context.attributes['client']['clientId']}

| clientName
| The name of the application
| {#context.attributes['client']['clientName']}

| name
| The name of the application (Same as clientName)
| {#context.attributes['client']['name']}

| metadata
| Map of Metadata associated to the application
| {#context.attributes['client']['metadata']['my-metadata-name']}

|===

==== User Profile information

You can access to the User information using this EL `{#context.attributes['user']}`.
This expression will return a UserProperties object with following attributes:

.`User` information
[cols="1,2,2"]
|===
|Attribute |Description |Syntax

| id
| User Internal identifier
| {#context.attributes['user']['id']}

| externalId
| User Identifier coming from the IdentityProvider
| {#context.attributes['user']['externalId']}

| domain
| Domain Internal identifier on which the user is attached
| {#context.attributes['user']['domain']}

| username
| Username
| {#context.attributes['user']['username']}

| firstname
| First name
| {#context.attributes['user']['firstname']}

| lastname
| Last name
| {#context.attributes['user']['lastname']}

| email
| email address
| {#context.attributes['user']['email']}

| source
| Internal ID of the Identity provider that identifies the user
| {#context.attributes['user']['source']}

| preferredLanguage
| Preferred Language defined in the user profile
| {#context.attributes['user']['preferredLanguage']}

| roles
| List of roles owned by the users (role name)
| {#context.attributes['user']['roles'][0]}

| groups
| List of groups on which the user is member of (group name)
| {#context.attributes['user']['groups'][0]}

| additionalInformation
| Map of additional information as displayed on the user detail page of the Management Console
| {#context.attributes['user']['additionalInformation']['preferred_username']}

| claims
| Map of additional information as displayed on the user detail page of the Management Console (same as additionalInformation)
| {#context.attributes['user']['claims']['preferred_username']}

|===

NOTE: As you may have noticed, `claims` and `additionalInformation` contain the same data. Depending on the place where the Expression Language is defined, the `claims` attribute may not be accessible whereas the `additionalInformation` attribute will always be present.

=== Add information into the EL context

Thanks to the flows and policies, you can add attributes to the context.
For example using the CalloutHttpPolicy, you can create an attribute using the response of the callout :

Attr Key : `callout-attribute`<commit_msg>AM: add information in Expression Language section about the access to the PAR values<commit_after>= Expression Language
:page-sidebar: am_3_x_sidebar
:page-permalink: am/current/am_userguide_expression_language.html
:page-folder: am/user-guide
:page-layout: am

== Overview

The AM Expression Language (EL for short) is one of the key features that can be used to configure various aspects of an AM domain.

=== Usage

The basic expression language syntax is as follows:

[code]
----
{#request.method}

{#context.attributes['user']}
----

See the sections below for example expression notations.

=== Information available through the Expression Language

To use the EL, it is important to know which information are available. In this section you can find a summary of what is available through the AL on AM.

NOTE: This page contains the most used elements, for some specific EL there are other information available. To be aware of these information, you can refer to the UI documentation by clicking on the information icon (the letter "i" into a circle) available into the EL field description.

==== Request information

It is sometime useful to access to the request information through the EL. As an example, you may want to check the presence of a scope in the authorization request to enforce MFA (`{#request.params['scope'][0] == 'write'}`)

.`Request` information
[cols="1,2,2"]
|===
|Attribute |Description |Syntax

| headers
| Headers of the HTTP request (MultiValueMap)
| {#request.headers['MyHeaderName'][0]}

| params
| Query parameters of the HTTP request (MultiValueMap)
| {#request.params['MyParam'][0]}

| scheme
| Scheme of the request (http, https)
| {#request.scheme}

| method
| Method of the request (POST, GET, ...)
| {#request.method}

| path
| Path of the request
| {#request.path}

| paths
| Array of string that contains each path element
| {#request.paths[0]}

|===

==== Application information

You can access to the client/app properties using this EL `{#context.attributes['client']}`.
This expression will return a ClientProperties object with following attributes:

.`Application` information
[cols="1,2,2"]
|===
|Attribute |Description |Syntax

| id
| Client/App Internal identifier
| {#context.attributes['client']['id']}

| domain
| Domain Internal identifier on which the application is attached
| {#context.attributes['client']['domain']}

| clientId
| The client_id of the application
| {#context.attributes['client']['clientId']}

| clientName
| The name of the application
| {#context.attributes['client']['clientName']}

| name
| The name of the application (Same as clientName)
| {#context.attributes['client']['name']}

| metadata
| Map of Metadata associated to the application
| {#context.attributes['client']['metadata']['my-metadata-name']}

|===

==== User Profile information

You can access to the User information using this EL `{#context.attributes['user']}`.
This expression will return a UserProperties object with following attributes:

.`User` information
[cols="1,2,2"]
|===
|Attribute |Description |Syntax

| id
| User Internal identifier
| {#context.attributes['user']['id']}

| externalId
| User Identifier coming from the IdentityProvider
| {#context.attributes['user']['externalId']}

| domain
| Domain Internal identifier on which the user is attached
| {#context.attributes['user']['domain']}

| username
| Username
| {#context.attributes['user']['username']}

| firstname
| First name
| {#context.attributes['user']['firstname']}

| lastname
| Last name
| {#context.attributes['user']['lastname']}

| email
| email address
| {#context.attributes['user']['email']}

| source
| Internal ID of the Identity provider that identifies the user
| {#context.attributes['user']['source']}

| preferredLanguage
| Preferred Language defined in the user profile
| {#context.attributes['user']['preferredLanguage']}

| roles
| List of roles owned by the users (role name)
| {#context.attributes['user']['roles'][0]}

| groups
| List of groups on which the user is member of (group name)
| {#context.attributes['user']['groups'][0]}

| additionalInformation
| Map of additional information as displayed on the user detail page of the Management Console
| {#context.attributes['user']['additionalInformation']['preferred_username']}

| claims
| Map of additional information as displayed on the user detail page of the Management Console (same as additionalInformation)
| {#context.attributes['user']['claims']['preferred_username']}

|===

NOTE: As you may have noticed, `claims` and `additionalInformation` contain the same data. Depending on the place where the Expression Language is defined, the `claims` attribute may not be accessible whereas the `additionalInformation` attribute will always be present.

==== Context attributes

The Context attributes contain all the information you can add to AM Flows using policies. 

* You can use the `authFlow` attribute to accumulate information across the authentication flow thanks to the Enrich Authentication Flow Policy. 
* The `authFlow.requestParameters` attribute contains the request parameters defined using the link:https://datatracker.ietf.org/doc/html/rfc9126[PAR specification].  

.`Context attributes` information
[cols="1,2,2"]
|===
|Attribute |Description |Syntax

| authFlow
| Map of data managed by the Enrich Authentication Flow.
| {#context.attributes['authFlow']['my-data']}

| authFlow.requestParameters
| Parameters provided through PAR specification
| {#context.attributes['authFlow']['requestParameters']['scope']}

|===

=== Add information into the EL context

Thanks to the flows and policies, you can add attributes to the context.
For example using the CalloutHttpPolicy, you can create an attribute using the response of the callout :

Attr Key : `callout-attribute`
{'fraction_non_alphanumeric': 0.11828156964850288, 'fraction_numerical': 0.0036265575599776826, 'mean_word_length': 5.586037966932027, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3319294', 'n_tokens_mistral': 2868, 'n_tokens_neox': 2782, 'n_words': 1164}