Handling a multi-value attribute question

[David Bantz]

On Thu, 6 Dec 2012, at 08:45 , "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> Attribute standards are worthless if we try
> and impose constraints that aren't part of the attribute definitions.

A good motto and foundation!

Lemmas for multi-valued attributes: 

Attributes defined as multi-valued may have multiple values,
and if you rely on that attribute, you need to assume that it sometimes
have multiple values.

Attributes with multiple values have no order - not even an arbitrary 
"order".  Repeated responses to the identical query may return the values in
a different order.  "First" or any other ordering designation can only refer to
the order in a specific instance of a response or assertion.

Attributes with multiple values do not entail "equivalence" or "indifference" 
of the values.  eduPersonAffiliation is multi-valued, but that does not
mean a service can take one of the asserted values and make that 
"the" affiliation of the person.  A service relying on that attribute must
be prepared to deal with multiple values or risk stupid inconsistent behavior.
Apply the same logic to givenName.

A service that makes the simplifying assumption that any value of
eduPerson or of givenName can be used as though it were the only
value is imposing a constraint that is not part of the attribute definition.

David Bantz

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121206/643b86a8/attachment-0001.html