Extracting multi value on NameFormat attribute

[Nate Klingenstein]

Prasanth,

> Are we able to extract multi value sent by idp for this saml attribute - memberOf  with above SP configuration?

Yes, you should be able to.  The values will all be concatenated by the SP into a single string that is ; delimited.  You can change the delimiter if you want.

https://wiki.shibboleth.net/confluence/display/SP3/XMLAttributeExtractorExamples

> What is the use of attaching <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/> and <AttributeDecoder xsi:type="ScopedAttributeDecoder"/> ?

caseSensitive="false" is used internally by the SP when it's enforcing access control rules or policies on its own, such as with the built-in RequestMapper.

https://wiki.shibboleth.net/confluence/display/SP3/XMLAttributeExtractorExamples

An additional attribute decoder element will generally apply special rules, but the StringAttributeDecoder doesn't do much other than allow you to attach flags like caseSensitive:

https://wiki.shibboleth.net/confluence/display/SP3/AttributeDecoder
https://wiki.shibboleth.net/confluence/display/SP3/String+AttributeDecoder

The Scoped attribute decoder does a little more.  The most important is that it's tied to the attribute filter which checks policy to ensure that the scope of the attribute matches a valid scope for the IdP in the IdP's metadata.

https://wiki.shibboleth.net/confluence/display/SP3/Scoped+AttributeDecoder

> Are we able to extract multi value sent by IdP for this saml attribute - memberOf with above SP configuration without attaching attribute decoder?

Yes, unless the values are scoped and you want to enforce those attribute policies, in which case you'll want to use a Scoped decoder.  A String AttributeDecoder is defaulted and implicit in an otherwise unqualified extractor.

Best wishes,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id