Centralized Shibboleth EDS with custom attributes

[Rod Widdowson]

> One aspect of my use case which I’ve been unable to find documentation on is that I am using a single identity provider
> (corresponding to a single MetadataProvider object in the Shibboelth2.xml conf file,) and I want EDS to result in the indication
of
> which IDP policy should be triggered by sending of a custom attribute in Shibboleth SP's AuthnRequest. This will be “agreed on”
earlier
> between SP, EDS and IDP, and the IDP will use the incoming attribute to determine how to authenticate the user.

There's a deep impedance mismatch here.  You have one IdP and the EDS is about selecting one IdP from many. 
 
>   *   Unauthenticated user accesses SP and is redirected to EDS
>   *   Based on user input, EDS responds back to SP with an an attribute (corresponding to a policy on the IDP)
>   *   SP makes authnRequest to identity provider including the attribute
>   *   IDP makes decision on incoming attribute on how to authenticate the user.

It's difficult to see how to fit that into the discovery protocol.   Indeed I don't see how it fits into any of the standard
protocols that the SP/IdP supports.  You cannot just add attributes.

Also I'm it's not clear what the different policies would be.

I'm assuming that you own both the IdP and the SP (Since you are proposing changes to both).  Can you put the user interaction into
a login flow?  Then that can help drive the Policy that the IdP has.  

/Rod