send one value of multi?

[Christopher Bongaarts]

On 11/4/2013 12:00 PM, David Bantz wrote:
> I know I could define an ad hoc single-valued attribute in the resolver.
> I've done something similar a few times already.  But I understand the 
> service to
> require mail with the mail OID - not some ginned up ad hoc attribute.
> So apparently it seems I need to somehow jigger the attribute release
> policy to only allow (an arbitrary) one of the set of values if that 
> is possible.

That's fine - you can have multiple attributes encoding to the same SAML 
attribute name.  So you'd have "mail" with multiple values encoding to 
the OID name, as well as "mail-single" encoding to the OID name but with 
enough logic to eliminate the other values (by being a Script attribute 
or pulling from a different source attribute).

Then release "mail-single" to the problem SP only.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131104/20f7fcde/attachment.html