Refusing to send an assertion if attribute not present?

[Erdos, Marlena]

I'm wondering if it's possible to exit out of the IdP's assertion creation
flow, if the user has authenticated successfully, but doesn't have a
particular attribute (or more precisely doesn't have a particular
attribute value). 

Reason: We don't want to create assertions for people who haven't picked
up id cards (and hence shown photo id -- that's the current thought anyway
:-).  (We have a "pickedUpIdCard" attribute in an LDAP directory.)

That is, I'm wondering if there is any hook with the
attribute-resolver.xml file to let me stop the process and return an error
page to the user.  (I've searched for such a hook, but that's not been
fruitful. Maybe I'm just using the wrong terms?)

I'm using external authentication, so my alternative is to check for
presence of the attribute in the the external authN callback servlet --
and maybe that's the place to do it, but I figured I'd ask.  (It seems
"wasteful" to be pulling attributes from LDAP twice -- once in the
callback and then again in the resolver.)

Thanks!
Marlena