Policy Server Guides › Policy Server Configuration Guide › Attributes and Expressions Reference › Functions Available within Expressions › MAYBE Function--Report an Indeterminate Result

MAYBE Function--Report an Indeterminate Result

You can write an expression that tests a condition and calls the function MAYBE if information needed for the test is missing or incomplete. When the expression evaluator encounters MAYBE, it tries to resolve the expression without the needed information. This is only possible when MAYBE is part of a compound expression.

For example, when the operator is AND and one operand is FALSE, the evaluator can determine that the result of the operation is FALSE. When one operand is TRUE and the other operand is undefined or both operands are undefined, the evaluator cannot determine the result of the operation. When both operands are TRUE, the result of the AND operation is TRUE.

Likewise, when the operator is OR and one operand is TRUE, the evaluator can determine that the result of the operation is TRUE. When one operand is FALSE and the other operand is undefined or both operands are undefined, the evaluator cannot determine the result of the operation. When both operands are FALSE, the result of the OR operation is FALSE.

If the evaluator cannot resolve the expression, it stops processing and the specified message is output to the console log or report depending on the context. MAYBE is typically called during role evaluation either in the context of a policy or report generation.

Typically, conditions depend on the time of day or an IP address or the value of a virtual user attribute (specified by the # sign), a user class (specified by the @ sign), a context variable (specified by the % sign), or a user attribute.

Note: In the case of LDAP user directories, the evaluator cannot determine whether a user attribute is defined.

Syntax

The MAYBE function has the following format:

MAYBE(message)

Parameters

The MAYBE function accepts the following parameter:

message (string)

Specifies the information that is missing and needed to evaluate a condition in an expression.

Return Value

The MAYBE function does not return.

Example

VEXIST(%ClientIP) ? #CheckIP : MAYBE('Client IP address is not defined.')
Message Output to the Console Log or Report: 'Client IP address is not defined.'