Releasing the same attribute with different friendly names?

[Rob Ansaldo]

I'm not sure why they would do this, but I inherited an IdP with some
attribute filter configurations where there are "OR"ed
PolicyRequrirementRules for multiple SPs and then some AttributeRule
definitions where they release the same attribute that has been defined
with different friendly names. For example something like this (a
simplified example):

<AttributeFilterPolicy id="questionablepolicy">
  <PolicyRequirementRule xsi:type="OR">
    <Rule xsi:type="Requester" value="some-sp"/>
    <Rule xsi:type="Requester" value="someother-sp"/>
       <Rule xsi:type="Requester" value="yup-someother-sp"/>
  </PolicyRequirementRule>
  <AttributeRule attributeID="lastname">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
  <AttributeRule attributeID="sn">
    <PermitValueRule xsi:type="ANY" />
  </AttributeRule>
</AttributeFilterPolicy>

ln my attribute-resolver, both lastname and sn come from the same LDAP
attribute and both have a name defined as "urn:oid:2.5.4.4", but have
different friendly names.

Can anyone think of why this would be necessary? Is there a case where the
SP cares what the friendlyname is? My interpretation is that a SP should
only use the name and the friendlyname is just for us humans. I'd like to
clean this up and remove the duplicates, but I worry about breaking
something.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230123/9da8f82b/attachment.htm>