attribute definition, template or other means?

[Baron Fujimoto]

We're still running IdP v3.2.1 (crustiness acknowledged)

I'm trying to define an attribute that looks something like eduPersonScopedAffiliation for one of our SPs.
E.g.: member at example.edu

The twist is that the scope we need is to be prefixed with a more granular org the user belongs to within the high level scope. 
E.g. if the member belongs to org "foo" at example.edu, then: member at foo.example.edu

Something like the following sort of works (based on the 3.3 example at <https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration>):

=====
     <resolver:AttributeDefinition xsi:type="ad:Template"
             id="eduPersonSubScopedAffiliation" >

         <resolver:Dependency ref="eduPersonAffiliation" />
         <resolver:Dependency ref="exampleOrg" />

         <resolver:AttributeEncoder xsi:type="enc:SAML2String"
                 name="eduPersonSubScopedAffiliation" />

         <ad:Template>
             <![CDATA[
                 ${eduPersonAffiliation}@${exampleOrg}.example.edu
              ]]>
         </ad:Template>

         <ad:SourceAttribute>eduPersonAffiliation</ad:SourceAttribute>
         <ad:SourceAttribute>exampleOrg</ad:SourceAttribute>

     </resolver:AttributeDefinition>
=====

Except it fails (as expected I think) when the exampleOrg attribute is multivalued.
E.g. if the member belongs to both the orgs "foo" and "bar" at example.edu

ERROR [net.shibboleth.idp.attribute.resolver.ad.impl.TemplateAttributeDefinition:299] - Attribute Definition 'eduPersonSubScopedAffiliation': All source attributes used in TemplateAttributeDefinition must have the same number of values: 'exampleOrg'

The documentation mentions this here:

<https://wiki.shibboleth.net/confluence/display/IDP30/TemplateAttributeDefinition>

And advises, "If you have result sets (e.g. from LDAP) that don't satisfy this rule, just make sure to enumerate the attributes you need", but I'm not sure how that translates into what I'd need to do to the attribute definition above.

What we'd like is for the resolver to return both "member at foo.example.edu" and "member at bar.example.edu" using the exampleOrgs above.

Alternatively, I'm also open to a different/better approach rather than using Template. Any tips and suggestions would be welcomed.

-- 
UH Information Technology Services : Identity & Access Mgmt, Middleware
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum