Shibboleth SP "remote user" functionality on Windows IIS

[Michael A. Grady]

I'd like to have the functionality that the Shib SP REMOTE_USER attribute mapping code provides, where you can provide a list of attributes and the first that has a value is used. But in the IIS environment, the documentation "discourages" using the corresponding HTTP_REMOTE_USER counterpart. It looks like Shib SP 2.5 will offer more attribute manipulation options, but I'm wondering -- short of using the HTTP_REMOTE_USER option -- how I might replicate the "use the first of these attributes that has a value" for the value of a mapped attribute with the 2.4.3. version of the SP. It strikes me that I might be able to do this with attribute filtering. 

First, does filtering happen after mapping? Am I filtering the values in the IDs/aliases mapped into, or the attributes being sent by the IdP before being mapped? If the former, would a script attribute filter be able to manipulate an ID's value? If the former, I assume I could filter out the one attribute value if the other attribute had a value, and then there would be only value to map into the ID. Can one of those work?

--
Mike Grady