<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/4/2013 12:00 PM, David Bantz
wrote:<br>
</div>
<blockquote
cite="mid:etPan.5277e0a0.515f007c.3545@q.swits.alaska.edu"
type="cite">
<div id="bloop_customfont"
style="font-family:Helvetica,Arial;font-size:13px; color:
rgba(0,0,0,1.0); margin: 0px; line-height: auto;">I know I could
define an ad hoc single-valued attribute in the resolver. </div>
<div id="bloop_customfont"
style="font-family:Helvetica,Arial;font-size:13px; color:
rgba(0,0,0,1.0); margin: 0px; line-height: auto;">I’ve done
something similar a few times already. But I understand the
service to</div>
<div id="bloop_customfont"
style="font-family:Helvetica,Arial;font-size:13px; color:
rgba(0,0,0,1.0); margin: 0px; line-height: auto;">require mail
with the mail OID - not some ginned up ad hoc attribute.</div>
<div id="bloop_customfont"
style="font-family:Helvetica,Arial;font-size:13px; color:
rgba(0,0,0,1.0); margin: 0px; line-height: auto;">So apparently
it seems I need to somehow jigger the attribute release </div>
<div id="bloop_customfont"
style="font-family:Helvetica,Arial;font-size:13px; color:
rgba(0,0,0,1.0); margin: 0px; line-height: auto;">policy to only
allow (an arbitrary) one of the set of values if that is
possible. </div>
</blockquote>
<br>
That's fine - you can have multiple attributes encoding to the same
SAML attribute name. So you'd have "mail" with multiple values
encoding to the OID name, as well as "mail-single" encoding to the
OID name but with enough logic to eliminate the other values (by
being a Script attribute or pulling from a different source
attribute).<br>
<br>
Then release "mail-single" to the problem SP only.<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>