SP Attribute Extractor multiple values when using NameID and Attribute

[Aaron Howell]

I was looking to fix up our mistaken NameID process from our previous configuration - so not using unspecified as per https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith%22Unspecified%22<https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration#CustomNameIDGenerationConfiguration-Dealingwith"Unspecified">. I’m in control of the SPs and IdP for this.

I’ve made the change in dev so now the SAML Assertion contains an attribute with a Name and a NameID with a Format for the same URI - using the URI for NameID is recommended and can’t filter the attribute before Generation. However it seems the SP extracts the two values and populates the one variable as multivalued with both values the same. I can’t seem to work out a way to stop this behaviour.

So the assertion contains:
<saml2:NameID xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oid:XXXXXXX" NameQualifier="https://idp.example.com/idp/shibboleth" SPNameQualifier="https://sp.example.com/shibboleth”>value</saml2:NameID>
<saml2:Attribute FriendlyName=“XXXXXXX" Name="urn:oid:XXXXXXX" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
      <saml2:AttributeValue>value</saml2:AttributeValue>
    </saml2:Attribute>

attribute-map.xml
<Attribute name="urn:oid:XXXXXXX" id=“XXXXXXX”/>

shibd.log
2017-04-05 12:00:17 DEBUG Shibboleth.AttributeDecoder.String [2]: decoding SimpleAttribute (XXXXXXX) from SAML 2 NameID with Format (urn:oid:XXXXXXX)
2017-04-05 12:00:17 DEBUG Shibboleth.AttributeDecoder.String [2]: decoding SimpleAttribute (XXXXXXX) from SAML 2 Attribute (urn:oid:XXXXXXX) with 1 value(s)
2017-04-05 12:00:17 DEBUG Shibboleth.AttributeFilter [2]: filtering 12 attribute(s) from (https://signon-sys.deakin.edu.au/idp/shibboleth)
2017-04-05 12:00:17 DEBUG Shibboleth.AttributeFilter [2]: applying filtering rule(s) for attribute (XXXXXXX) from (https://signon-sys.deakin.edu.au/idp/shibboleth)
2017-04-05 12:00:17 DEBUG Shibboleth.AttributeFilter [2]: applying filtering rule(s) for attribute (XXXXXXX) from (https://signon-sys.deakin.edu.au/idp/shibboleth)


When I inspect the attribute I get:
XXXXXXX: “value;value”
instead of the previous:
XXXXXXX: “value”

Is there something else I should be doing here instead?

Cheers,
Aaron

Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170405/d2d3ba31/attachment.html>