<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 29 May 2013, at 17:25, Mike Flynn <<a href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><div style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, sans-serif; font-size: 12pt; position: static; z-index: auto; ">Is it possible for an Idp to send multiple copies of the same attribute? I have a customer saying they want to send the same attribute multiple times to us with different values.</div></div></blockquote><div><br></div><div>Although many attributes are defined to be single-valued, many others are defined to be multi-valued, which is what I think you're talking about here.</div><div><br></div><div>So, for example, eduPersonScopedAffliation is a multi-vallued attribute. Saying that someone is both a "<a href="mailto:member@example.edu">member@example.edu</a>" and also a "<a href="mailto:student@example.edu">student@example.edu</a>" is achieved by sending multiple values to your SP. The SP normally presents these to the application separated by ";"s, so:</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="mailto:member@example.edu">member@example.edu</a>;<a href="mailto:student@example.edu">student@example.edu</a></div><div><br></div><blockquote type="cite"><div><div style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, sans-serif; font-size: 12pt; position: static; z-index: auto; ">I have told them we do not support doing that but I was curious if this is an accepted practice or common for an Idp to do this.</div></div></blockquote><div><br></div><div>Whether an IdP *should* be sending multiple values to you depends partly on the definition of the attribute but mainly on your business relationship and their risk profile. For example, although a single subject might have multiple affiliation values associated with them, an IdP would often choose only to release to an SP those specific values required by the SP.</div><br><blockquote type="cite"><div><div style="background-color: rgb(255, 255, 255); font-family: arial, helvetica, sans-serif; font-size: 12pt; position: static; z-index: auto; "> We could support this with code updates to manage it but I wanted to see if this is a legit or even common practice.</div></div></blockquote></div><div><br></div><div>It's hard to give a definitive answer without details about which attributes and which value we're talking about. But just as guidance, if we're talking about something where the SP is matching values for authorization purposes (e.g., scoped affiliation or entitlements) you're going to be more flexible if you allow for the possibility that uninteresting values may accompany the ones you care about (Postel's law: be conservative in what you do, be liberal in what you accept from others).</div><div>
<span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div><span class="Apple-tab-span" style="white-space: pre; "><br class="Apple-interchange-newline"> </span>-- Ian<br></div><div><span class="Apple-style-span" style="font-size: medium; "><br></span></div></span></span><br class="Apple-interchange-newline">
</div>
<br></body></html>