SP Attribute Extractor multiple values when using NameID and Attribute

[Cantor, Scott]

On 4/5/17, 1:19 AM, "users on behalf of Aaron Howell" <users-bounces at shibboleth.net on behalf of aaron.howell at deakin.edu.au> wrote:

> I’ve made the change in dev so now the SAML Assertion contains an attribute with a Name and a NameID with a Format for the
> same URI - using the URI for NameID is recommended and can’t filter the attribute before Generation. However it seems the
> SP extracts the two values and populates the one variable as multivalued with both values the same. I can’t seem to work out a
> way to stop this behaviour.

The only SP that does this is Shibboleth and no Shibboleth SP ever needs a NameID, so your problem goes away by itself, just don't use a NameID.

The only way to prevent it at the SP is with an expensive per-request de-duplication option that was added in 2.6. It makes no sense to use it when you're in control of both ends, you already have your problem solved by just not sending the NameID you didn't need to start with.

-- Scott