Refusing to send an assertion if attribute not present?

[David Gersic]

>>> On 3/12/2013 at 03:49 PM, "Erdos, Marlena" <marlena_erdos at harvard.edu> wrote: 

> I'm wondering if it's possible to exit out of the IdP's assertion creation
> flow, if the user has authenticated successfully, but doesn't have a
> particular attribute (or more precisely doesn't have a particular
> attribute value). 
> 
> Reason: We don't want to create assertions for people who haven't picked
> up id cards (and hence shown photo id -- that's the current thought anyway
> :-).  (We have a "pickedUpIdCard" attribute in an LDAP directory.)

In your LDAP search filter, adding "pickedupIdCard=true" would then fail to find anybody that hadn't picked up their card.