Shibboleth Developers

[Ian Young <>]

Scott Cantor wrote:

>> I can't find any indication that SAML takes an explicit position on
>> attribute values, but my observation is that the OpenSAML 1 code (and
>> thus the 1.3.x IdP) implements everything using ArrayLists, which is to
>> say that if you push three "foo" values in, then they'll all come out
>> the other end and ultimately end up in the application at the SP as
>> "foo;foo;foo".
> 
> Just for the record, I have no intention of doing anything about this in the
> SP, in either version. It's too complicated to mess with attribute values
> beyond just getting the damn things extracted, and I see no reason why an
> application should be so stupid as to care about duplicates. So that's my
> story and I'm sticking to it...

That seems reasonable, particularly if the SAML spec doesn't actually
say that duplicate values are forbidden.

        -- Ian