redundant attributes in IdPs SAML assertion

[Cantor, Scott]

On 6/11/14, 11:12 AM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:
>
>So then the data connector should know better than to supply duplicate
>values to the resolver.

Data connectors are supplying raw internal data, so I suspect in fact they
may well supply duplicates, for example if you had duplicate rows in a
database.

When attributes get built, a given BasicAttribute de-dups data added to it
to some extent, though I'm not sure about that.

What's happening here is not duplicate values, but duplicated
BasicAttribute instances in the resolved attribute set, encoded
independently to the same name. That suggests multiple sources of resolved
attribute objects coming together in the final set.

-- Scott