Handling a multi-value attribute question

[Peter Schober]

* Mike Flynn <shibbolethlynda at yahoo.com> [2012-12-06 15:47]:
> Thanks, Dave.  Unfortunately that won't work as we need first and
> last name separate and displayname is a combination of those...

I've long had the need for, say, displayGivenName and displaySn, in
all those cases where an application insists on getting these as two
seperate pieces of data (and of course there's no way to reliably
split a single string into "correct" components automagically), but no
such thing exists and getting anything new widely deployed is, well,
highly unlikely.

So you're best bet is to just either grab any of the values (e.g. if
the IdP grabs them from an LDAP DSA they're possibly being returned in
"database order", i.e., in the order the data was loaded is is now
being stored, nothing useful to anyone) and/or tell institutions to
only send you one value.

Given that the latter might not make a significant difference during
the average lifetime of a natural person you're probably left with
the former.
-peter