<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">The replication of attribute assertions in the SAML assertion is robust and reproducible for those directory attributes manipulated to produce SAML attributes using the same name in an environment including local directory results caching and the repeated invocation of attribute resolver triggered by MCB. <div><br></div><div>The work-around we’ve implemented is to </div><div>1. not encode the directory attribute (e.g., not encode eduPersonAffiliation), instead </div><div>2. defining and manipulating a new local/internal attribute with its own id (e.g., uakeduPersonAffiliation) that has a dependency on the attribute with the canonical name and </div><div>3. encoding that manipulated local attribute (uakeduPersonAffiliation) as the canonical attribute (e.g., as <span style="font-family: 'Lucida Sans';">urn:oid:1.3.6.1.4.1.5923.1.1.1.1</span><span style="color: rgb(255, 147, 0); font-family: 'Lucida Sans'; font-size: 13px;"> </span>for eduPersonAffiliation). </div><div>4. Then of course, the attribute filter has to release the attribute with the new internal id (e.g., uakeduPersonAffiliation).</div><div><br></div><div>Not elegant, but almost easier to do than to describe, and it has resolved the issue.</div><div><br></div><div>David Bantz</div><div>UA IAM</div><div><div><br></div><div><br><div><div>On Tue, 10 Jun 2014, at 18:50 , David Bantz <<a href="mailto:dabantz@Alaska.edu">dabantz@Alaska.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">With MCB, Duo, and LDAP caching in my IdP 2.4.0, I am seeing double or triple (if 2FA) copies of eduPersonAffiliation in the SAML assertion:<div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Member</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Staff</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Employee</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml2:Attribute></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Member</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Staff</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Employee</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml2:Attribute></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:Attribute FriendlyName="eduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Member</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Staff</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194); position: static; z-index: auto;"> <saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>" xsi:type="xs:string">Employee</saml2:AttributeValue></div><div style="margin: 0px; font-size: 11px; font-family: Monaco; background-color: rgb(255, 250, 194);"> </saml2:Attribute></div></div></div></blockquote>...</div><br></div></div></body></html>