duplicate metadata from an IdP

[Cantor, Scott]

On 6/18/14, 12:16 PM, "Brian Tingle" <Brian.Tingle at ucop.edu> wrote:

>Is this
>  a) something I can work around in attribute-filter.xml?

Not easily. There's a filter function that operates based on number of
values, but I've never managed to make it do anything sensibly for these
kinds of cases because by the time that's running you've already mapped
them both to one attribute.

It might work to map each one separately, and then alias both to mail, and
then apply a filter rule to the one name that applies if the issuer is a
particular IdP and block it. I don't really recall anymore what it will do
when it comes to aliases.

>  b) something I need to contact the IdP about (asking them to send one
>or the other)?

That is in fact a bug in every case, there is no SAML version for which
both those names are valid. So one or the other is simply invalid.

>  c) something I need to file a bug against my vendor application for?

And yes, mail is multi-valued anyway, so it is by definition a bug if you
don't handle that.

-- Scott