For the record, our implementation SPSSODescriptor#getDefaultAttributeConsumerService() does the right thing (I entered this rathole because I thought I saw that it not doing so in early tests). /Rod