how to add a non-single valued attribute, like memberOf

[Cantor, Scott]

> I don't see anything in eduPerson [1] that seems right.

There isn't, other than the eduMember work, but a good practice IMHO is to always encode groups as URIs and then you can just treat them as entitlements. There are people who have deep prejudices about the difference between groups and entitlements, but I'm not one of them.

-- Scott