Name attribute duplicated in IIS HTTP headers

[j.grootlipman at facilitor.nl]

We are using the shibboleth 3.1.0.2 Service Provider on Windows IIS with Classic ASP
.
The problem: an attribute that is only sent with a single value appears as multi-value in the http-header
So: <AttributeValue>john at example.com</AttributeValue<mailto:john at example.com%3c/AttributeValue>> becomes
     john at example.com;john at example.com
in the http-header

The john at example.com  occurs twice in the SAML:Response. The Identity Provider (https://login.microsoftonline.com ) sends:
        <Subject>
            <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">john at example.com</NameID>
            <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <SubjectConfirmationData InResponseTo="_d2b5dcbcad209183b27d390c57284c49" NotOnOrAfter="2021-04-09T15:35:19.066Z" Recipient="...snip..."/>
            </SubjectConfirmation>
        </Subject>
And also
        <AttributeStatement>
            ...snip...
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
                <AttributeValue>john at example.com</AttributeValue>
            </Attribute>
        </AttributeStatement>

The attribute-map.xml has:

<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
               nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
               id="fcltName">
    </Attribute>
    <Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"
               nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
               id="fcltUPN">
    </Attribute>
    <Attribute name="SAM"
               nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
               id="fcltSAM">
    </Attribute>
    <Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
               nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
               id="fcltEmail">
    </Attribute>
    <Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"
               nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
               id="fcltSurname">
    </Attribute>
    <Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
               nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
               id="fcltGivenname">
    </Attribute>
    <Attribute name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"
               nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
               id="fcltUPN">
    </Attribute>
</Attributes>

The DEBUG logging shows :
2021-04-09 16:35:19 DEBUG Shibboleth.AttributeExtractor.XML [1] [flex]: skipping NameID with format (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress)
and
2021-04-09 16:35:19 DEBUG Shibboleth.AttributeDecoder.String [1] [flex]: decoding SimpleAttribute (fcltName) from SAML 2 Attribute (http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name) with 1 value(s)

As far as I understand the NameID email address gets ignored and and attribute e-mail address really has only 1 value.

Perhaps relevant: we run the ISAPI with useHeaders="true" useVariables="false" as we are running Classic ASP and noticed the variables where not populated
This does not give us any problems with many identical configurations for different identity.

What can be wrong here? Is the NameID value appended to the attribute? Or is the attribute duplicated?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210410/768db1ab/attachment.htm>