Hi guys,

I see that as primarily a question of "What do we actually want to achieve with the check?"

This isn't really ment to say it checks the regexp is "safe" - the condition was primarily ment as something that distinguishes an ordinary string value from a regexp (erring on the side of treating things as ordinary string if not sure).

The very original code (prior to 6afc6a736361c795d1bd46c1bad126badb35e43e) was to check whether it contains a '*' or '+'.

We want to prevent some really dodge expressions that would harvest too many values from an IdP, but insisting on full string matching sounds reasonable to me.

Long-term, we should make all of this go through an approval workflow:
* new eduPersonEntitlement values.
* changes to eduPersonEntitlement values.
* changes to Scope.

(Not sure how the domain model would support approval workflow for _changing_ entries - keep the old value in use until the new entry is approved).


@smangelsdorf , your thoughts?

Cheers,
Vlad