Some attributes are duplicated in response

[Conner, Mike]

I wonder if anyone could help me troubleshoot an issue I haven't been able to understand. My Shib IdP is adding duplicate attribute values to the outgoing assertion.
In the logs it appears that eduPersonScopedAffiliation has 1 value, eduPersonAffiliation has 1 value and eduPersonAssurance has 4 values.
When these values are added and encoded for the assertion, they are duplicated.
Where and why is this happening?

*** LOGS ***
DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'eduPersonAffiliation' remained after filtering
DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] - Attribute filtering engine 'ShibbolethAttributeFilter': 1 values for attribute 'eduPersonScopedAffiliation' remained after filtering
DEBUG [net.shibboleth.idp.attribute.filter.impl.AttributeFilterImpl:190] - Attribute filtering engine 'ShibbolethAttributeFilter': 4 values for attribute 'eduPersonAssurance' remained after filtering
...
DEBUG [net.shibboleth.idp.saml.profile.impl.BaseAddAttributeStatementToAssertion:265] - Profile Action AddAttributeStatementToAssertion: Attempting to add an AttributeStatement to outgoing Assertion
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227] - Profile Action AddAttributeStatementToAssertion: Attempting to encode attribute eduPersonAssurance as a SAML 2 Attribute
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/ID/eppn-unique-reassign-1y of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/IAP/low of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/IAP/medium of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/ID/eppn-unique-reassign-1y of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/IAP/low of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value https://refeds.org/assurance/IAP/medium of attribute eduPersonAssurance
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227] - Profile Action AddAttributeStatementToAssertion: Attempting to encode attribute eduPersonScopedAffiliation as a SAML 2 Attribute
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member at grinnell.edu of attribute eduPersonScopedAffiliation
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member at grinnell.edu of attribute eduPersonScopedAffiliation
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.AddAttributeStatementToAssertion:227] - Profile Action AddAttributeStatementToAssertion: Attempting to encode attribute eduPersonAffiliation as a SAML 2 Attribute
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member of attribute eduPersonAffiliation
DEBUG [net.shibboleth.idp.saml.attribute.transcoding.SAMLEncoderSupport:73] - Encoding value member of attribute eduPersonAffiliation
*** END LOGS ***

*** RESULTING ASSERTION ***
<saml2:AttributeStatement>
            <saml2:Attribute FriendlyName="eduPersonAssurance"
                             Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue>https://refeds.org/assurance</saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/ID/eppn-unique-reassign-1y</saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/IAP/low</saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/IAP/medium</saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance</saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/ID/eppn-unique-reassign-1y</saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/IAP/low</saml2:AttributeValue>
                <saml2:AttributeValue>https://refeds.org/assurance/IAP/medium</saml2:AttributeValue>
            </saml2:Attribute>
            <saml2:Attribute FriendlyName="eduPersonScopedAffiliation"
                             Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue>member at grinnell.edu</saml2:AttributeValue>
                <saml2:AttributeValue>member at grinnell.edu</saml2:AttributeValue>
            </saml2:Attribute>
            <saml2:Attribute FriendlyName="eduPersonAffiliation"
                             Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
                             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                             >
                <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                                      xsi:type="xsd:string"
                                      >member</saml2:AttributeValue>
                <saml2:AttributeValue>member</saml2:AttributeValue>
            </saml2:Attribute>
*** END ASSERTION ***


Internal
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241025/5307afad/attachment.htm>