diff --git a/services/saml/response/SamlResponseBuilder.cfc b/services/saml/response/SamlResponseBuilder.cfc
index 079a915..70053ca 100644
--- a/services/saml/response/SamlResponseBuilder.cfc
+++ b/services/saml/response/SamlResponseBuilder.cfc
@@ -235,8 +235,14 @@ component {
 			} else {
 				xml &= '<saml:Attribute Name="#key#">';
 			}
+			if ( IsArray( arguments.attributes[ key ] ) ) {
+				for ( var val in arguments.attributes[ key ] ) {
+					xml &= '<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">#XmlFormat( val )#</saml:AttributeValue>';
+				}
+			} else {
+				xml &= '<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">#XmlFormat( arguments.attributes[ key ] )#</saml:AttributeValue>';
+			}
 
-			xml &= '<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">#XmlFormat( arguments.attributes[ key ] )#</saml:AttributeValue>';
 			xml &= '</saml:Attribute>';
 		}
 
diff --git a/tests/unit/ResponseBuilderTest.cfc b/tests/unit/ResponseBuilderTest.cfc
index ac016da..61cc8db 100644
--- a/tests/unit/ResponseBuilderTest.cfc
+++ b/tests/unit/ResponseBuilderTest.cfc
@@ -56,6 +56,47 @@ component extends="testbox.system.BaseSpec" {
 					fail( "SAML did not validate" );
 				}
 			} );
+
+			it( "should include one AttributeValue element when attribute is a string with a single value", function(){
+				var builder  = _getBuilder();
+				var response = builder.buildAuthenticationAssertion(
+					  issuer              = "http://www.thewebsite.com/"
+					, nameIdFormat        = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
+					, nameIdValue         = "test@test.com"
+					, inResponseTo        = "aaf23196-1773-2113-474a-fe114412ab72"
+					, recipientUrl        = "https://sp.example.com/SAML2/SSO/POST"
+					, audience            = "https://sp.example.com/SAML2"
+					, sessionTimeout      = 30
+					, sessionIndex        = "C894146D-598F-4D9B-8733ACF80280C4B7"
+					, attributes          = { expertise = "admin" }
+					, privateKey          = testPk
+					, publicCertificate   = testCert
+				);
+
+				var matches = ReMatchNoCase( "<(?:[A-Za-z0-9-]+:)?AttributeValue[ >]", response );
+				expect( ArrayLen( matches ) ).toBe( 1 );
+			} );
+
+			it( "should include two AttributeValue elements when attribute has multiple values", function(){
+				var builder  = _getBuilder();
+				var response = builder.buildAuthenticationAssertion(
+					  issuer              = "http://www.thewebsite.com/"
+					, nameIdFormat        = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
+					, nameIdValue         = "test@test.com"
+					, inResponseTo        = "aaf23196-1773-2113-474a-fe114412ab72"
+					, recipientUrl        = "https://sp.example.com/SAML2/SSO/POST"
+					, audience            = "https://sp.example.com/SAML2"
+					, sessionTimeout      = 30
+					, sessionIndex        = "C894146D-598F-4D9B-8733ACF80280C4B7"
+					, attributes          = { expertise=[ "admin", "expert" ] }
+					, privateKey          = testPk
+					, publicCertificate   = testCert
+				);
+
+				var matches = ReMatchNoCase( "<(?:[A-Za-z0-9-]+:)?AttributeValue[ >]", response );
+				expect( ArrayLen( matches ) ).toBe( 2 );
+			} );
+
 		} );
 
 		describe( "buildErrorResponse()", function(){