Multiple copies of an attribute?

[Cantor, Scott]

On 5/29/13 12:25 PM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:

>Is it possible for an Idp to send multiple copies of the same attribute?
>I have a customer saying they want to send the same attribute multiple
>times to us with different values.

Ian addressed one aspect of this, but there are a lot of variations here.
The attributes you see are not what's on the wire, that's the point of the
SP's functionality.

You could get two or more different SAML attributes that you extract into
one. They could send multiple values in one attribute (as Ian meant). And
lastly, they could violate the SAML general guidance, and send the same
attribute twice with different values, and the SP won't fail on that.

At the end, you get whatever you choose to support and extract.

You should *always* be handling multiple values just as a matter of
course, because anything else is just asking for things to break.

The only exception is if you map a single-valued attribute in SAML to a
single header, so you control the cardinality and can tell anybody
violating that to stop.

-- Scott