Multiple RelyingPartyByName Matches

[Klingenstein, Nate]

Configuration hygiene question.

https://wiki.shibboleth.net/confluence/pages/viewpage.action?spaceKey=IDP30&title=RelyingPartyConfiguration

"This leads to a rule of thumb for overrides: more general matches (i.e. by group) should be placed after more specific matches (i.e. by name)."

I have one container element that turns off encryption for a bunch of services.  We're pulling in metadata for these providers dynamically.  I need to both turn off encryption and force the use of a special entityID when talking to https://creative.sp.two/.  I hoped this would work:

        <!-- Container relying party override for services that can't support encryption -->
        <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://creative.sp.one/', 'https://creative.sp.two/' }}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

        <!-- Override to force the use of a different entityID with select partners -->
        <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://creative.sp.two'}}" p:responderId-ref="specialEntityID" />

so that I wouldn't need to turn off encryption separately.  If I do that, first match apparently wins.  Defining https://creative.sp.two/ totally independently works:

        <!-- Override to force the use of a different entityID and disable encryption with especially special partners -->
        <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://creative.sp.two/'}}" p:responderId-ref="specialEntityID">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>

What's the "right" way to do this?  Dynamically insert tags into the metadata and match on those, or...?