Re: AttributeStatement differences IdP v3 → v4 ?

[Cantor, Scott]

You're probably talking about https://shibboleth.atlassian.net/browse/IDP-1936

It is not a good idea in SAML to have two Attributes with the same name in an assertion, and while the Shibboleth SP handles that in a sane way, many won't (you might get the first one, the last, or both). I knew that it was doing that and I finally fixed it. It's always been broken, I think possibly as far back as the first versions, but I don't know for sure. It was just something you should never do, but I wanted it to do the right thing, finally, if somebody did it by accident.

That should be the outcome you want if you're mapping two IdPAttributes to one SAML Attribute, otherwise you have little control over what the SP will do with it. If that's not what you want, you just shouldn't encode them to the same SAML Attribute.

I don't see how you could have been "depending" on this before. A Shibboleth SP would have just combined them on the other end anyway, so it's not a change, and most other SPs wouldn't do anything predictable at all and you'd never want to depend on whatever they were doing.

-- Scott