> it seems that the juniper take the multi valued MemberOf returned by > shibboleth idp for a single group :/ You can verify that, just trace the XML in the log, but yes, I think that’s Juniper's behavior. -- Scott