Shibboleth Developers

["Cantor, Scott E." <>]

> Another (better?) approach is to define *two*
> <md:AttributeConsumingService> elements in SP metadata, and then let
> the SP try them in turn. If the first one fails (because the IdP can
> not or will not supply a required attribute), then the SP simply tries
> again.

I don't think looping back to the IdP is a viable strategy. It certainly 
won't fly if you end up prompting the user both times, which is pretty much 
what it would lead to.

I explored a number of ways to use multiple descriptors to solve problems and 
none of them were solving anything. Its purpose was specifically to support 
different attribute sets within a single SP. A simple example is a gateway 
protecting a dozen apps with different requirements. It works fine for that 
(assuming SAML 2).

-- Scott