> I recommend not using them. Use application code if you have to use them. I also explicitly pointed out that anybody accepting comma-delimited attribute values in SAML is nuts. Tell the IdP to fix it, and you don't need a regex. -- Scott