Shibboleth Developers

["Tom Scavo" <>]

Suppose IdPA pushes both an authentication assertion and an attribute
assertion to the SP.  Assume the NemeIdentifier is a globally unique
(persistent) principal identifier (such as ePPN or ePTID).  Suppose
further that the NameQualifier attribute is set to the providerId of
IdPB. Is there any way to force an attribute query to IdPB despite the
fact that the SP has already consumed the attribute assertion from
IdPA?

If not, can we trigger the query by augmenting one of the assertions
in some way, perhaps by putting a special URI in the
AuthenticationMethod attribute of the authentication assertion (which
is needed anyway for the use case I have in mind) or by specifying a
new SAML attribute (whose value is a providerId) especially designed
for this purpose?

Thanks,
Tom