multiple attributes

I can't find anything in any of the SAML specs that prohibits multiple
occurrences of the same attribute in a SAML attribute assertion.  For
example, if an IdP wished to assert two e-mail addresses, it seems the
IdP could formulate one attribute with two values or two attributes
(with the same name) each with a single value.  Am I interpreting this
correctly?

Thanks,

Tom Scavo
NCSA