<div dir="ltr"><div dir="ltr">On Tue, May 26, 2020 at 11:58 PM leosimon <<a href="mailto:leosimon@digital-nirvana.com">leosimon@digital-nirvana.com</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">If I would have to limit the data with resolver or filter config, then any<br>
one of the values of the attribute will be passed to the consent page and<br>
released to SP right?</blockquote><div><br></div><div>If you simply pull the "first" value from mail attribute with ScriptedAttribute including something like:<br>





<p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:17px;line-height:normal;font-family:Menlo">





</p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><font color="#000000" style=""><font face="Menlo" style="">single-valued-mail.addValue(email.getValues().get(0));</font><br><font face="arial, sans-serif" style="">then right, AFAIK you cannot be assured of resolving the same value on subsequent logins.<br><br>That might be OK if the SP were using that attribute to send email, but they are likely using it as<br>a persistent scoped user identifier. In which case you need a different strategy, such as encoding a scoped principal</font></font></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><font color="#000000" style=""><font face="arial, sans-serif" style="">name or building a scoped identifier from a uid; a different </font></font></span>ScriptedAttribute including something like:<br>





</p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal;font-family:Menlo"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><font color="#000000">value = userid.getValues().get(0);</font></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal">
</p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal;font-family:Menlo"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><font color="#000000">single-valued-fake-mail.getValues().add(value + "@your.tld");</font></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal;font-family:Menlo"><span class="gmail-s1" style="font-variant-ligatures:no-common-ligatures"><font color="#000000"><br></font></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><font face="arial, sans-serif"><font color="#000000" style=""><span style="font-variant-ligatures:no-common-ligatures">At my institution at least that "</span></font>single-valued-fake-mail"<span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)"> represents a persistent non-reassignable routable email address, <br></span></font><span style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0)"><font face="arial, sans-serif">"canonicalEmail", for all users, so it's not a totally bad approa</font><font face="Menlo">ch. </font></span></p></div><div><font face="arial, sans-serif"> </font></div><div><font face="arial, sans-serif">David Bantz</font></div></div></div>