Can an attribute be sent as an array?

[Cantor, Scott]

On 3/7/13 1:25 PM, "Scott Hall" <shall05 at MIT.EDU> wrote:

>Split an LDAP attribute value on a delimiter so that the IdP reads it
>into a list or array.
>
>Read an LDAP attribute that is a list or array in so that it can pass
>that on as a list or array.
>
>Pass the list/array onto the SP.
>
>Configure the SP to be able to send that list or array in as multiple
>HTTP Header values with the same header name.

Support for multiple values is already part of the system. I don't know if
there's a non-scriptlet attribute definition that can split values in the
IdP, but it could certainly be done that way.

The SP exposes multiple values mapped to a name using a delimiter in the
header. Multiple headers doesn't work the way you imply it would and that
isn't a way of distinguishing it.

There is no built-in concept of arrays within a single value on the wire.
XML has the concept of space-delim'd lists but the SP has no decoder
explicitly aware of that within a single value, and using lists that way
would be somewhat at odds with SAML's approach to attributes.

-- Scott