<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Hello,<br>
<br>
We have shibboleth SP that we have recently pointed to azure-as-idp and its working fine for authentication but, for every claim coming back from Azure, say "email", Shibboleth SP (3.0.1) seems to be double-setting the value, ex:</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">"email: sean@domain.com; sean@domain.com"<br>
<br>
When I trace the logs however, the IDP (azure) is only sending a single value:<br>
<span class="hljs-tag"><br>
<<span class="hljs-name">Attribute</span> <span class="hljs-attr">Name</span>=<span class="hljs-string">"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"</span>></span></p>
<p style="margin-top:0;margin-bottom:0"><span class="hljs-tag"></span><span class="hljs-tag"> <<span class="hljs-name">AttributeValue</span>>sean@domain.com</span><span class="hljs-tag"></<span class="hljs-name">AttributeValue</span>></span><span class="hljs-tag"></span></p>
<p style="margin-top:0;margin-bottom:0"><span class="hljs-tag"></Attribute><br>
<br>
Additionally, when I look in the shib looks it seems to know its only one value when it decodes it:<br>
<br>
</p>
<div>2018-11-05 19:14:33|Shibboleth-TRANSACTION|Cached the following attributes with session (ID: _b3f8ea8e8f86df25b6af513ebc2f142d) for (applicationId: default) {</div>
<div>2018-11-05 19:14:33|Shibboleth-TRANSACTION|<span style="white-space:pre"> </span>
<span style="font-family: Calibri, Helvetica, sans-serif, Helvetica, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;">email</span> (1 values)<br>
<br>
And, for some attributes that need to be reformatted, we use the Template attribute resolver plugin and, for those attributes- it's only a single value, ex:<br>
<span style="font-family: Calibri, Helvetica, sans-serif, Helvetica, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px;"><br>
this: <AttributeResolver type="Template" sources="email" dest="primary-mail"></span></div>
<div>gives the single attribute value: sean@domain.com<br>
<br>
<br>
</div>
<div>So it's only the 'unchanged' attributes that come directly from Azure that seem to have duplicate values</div>
<div><br>
</div>
<div><br>
I have not seen this before. Any suggestions? Perhaps I'm making a simple error in the attribute resolver config, but everything looks correct and comparable to past deploys (though, again, this is the first time with azure).<br>
<br>
Thanks for your time.<br>
<br>
Sean</div>
<div></div>
<br>
</span>
<p></p>
</div>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<title>J. Walter Thompson</title>
<p style="font-family: 'Calibri', arial, sans-serif; font-size: 9px;">This transmission is intended solely for the person or organization to whom it is addressed and it may contain privileged and confidential information. If you are not the intended recipient
you should not copy, distribute or take any action in reliance on it. If you believe you received this transmission in error please notify the sender.
</p>
</body>
</html>