duplicate metadata from an IdP

[Peter Schober]

* Brian Tingle <Brian.Tingle at ucop.edu> [2014-06-18 18:16]:
> One of my campuses sends me BOTH attributes.
> 
> My vendor application ends up seeing "user at example.edu;user at example.edu" as the email address.

At the SP (you mentioned an attribute-map.xml, so I'm assuming the SP
is also Shibboleth) you could map them both to different attribute ids
and then create an attribute-policy.xml which throws away/denies the
acceptence of one attribute iff the other also has a value (though
that doesn't tell you whether the values themselfs are in fact the
same), preferring one over the other if both exist.
To shield the application from having to check for both attribute
names then (in case only one or the other was sent) you could use a
Template attribute resolver to create/replace a canonical name for the
attribute and take the value from either of the two named variants.

Repeat this for each attribute where something like this could happen
(i.e., all attributes not defined to be single-valued), clearly this
is crazy. Esp. when compared to simply turning the list of attribute
values into a Set inside the application code, thereby eliminating any
duplicate values from the list.

But as Scott already said, in this specific case of sending both the
SAML1 name and the SAML2 name in the same transaction should be fixed
at the IDP.
-peter