SP rule for limiting the number of attribute values

[Paul Caskey]

Hi Everyone-

We occasionally receive assertions which contain multi ePPN attributes.  Usually, they are the same value, but our apps receive them as multi-valued (e.g. value at domain.edu;value at domain.edu<mailto:value at domain.edu;value at domain.edu>).

I know this is an IdP configuration problem, but we have apps that assume ePPN to be single-valued (as the spec for that says), so we'd like to limit the SP to presenting only one value to the apps.

We've tried to use a PermitValueRule for this and we've tried a few different things, but we always seem to end up with no ePPN values seen by the apps.

Here's the one we've tried that seems like it should work since it follows other similar examples in the attribute-policy.xml file:

   <PermitValueRule id="SingleValue">
        <Rule xsi:type="NumberOfAttributeValues" minimum="1" maximum="1"/>
    </PermitValueRule>
....
        <AttributeRule attributeID="eppn">
            <PermitValueRule xsi:type="AND">
               <RuleReference ref="ScopingRules"/>
               <RuleReference ref="SingleValue"/>
            </PermitValueRule>
        </AttributeRule>

Can anyone point us in the right direction?


TIA,
-Paul
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240119/55970c59/attachment.htm>