Does the IdP and/or the SP send a custom user-agent string along with every HTTP request for metadata? That would be a sure way to know the Shib versions in use throughout a federation. Thanks, Tom