Two endpoints, same entityID, different attribute filter?

[Eric Hattemer]

I'm trying to integrate
http://docs.marketo.com/display/public/DOCS/Add+Single+Sign-On+to+a+Portal#AddSingleSign-OntoaPortal-UpdateSAMLSettings
on IDP 3.2.1 and I think I have it working, but not in a very flexible
way.  It says:

Send the SSO request, which is a SAML response, to
https://login.marketo.com/saml/assertion/<your-munchkin-id>
As the SP’s Audience URL , use http://saml.marketo.com/sp
If you are using the SPNameQualifier attribute, set the NameID element
for Subject to http://saml.marketo.com/sp

By default in the IDP, I think the Audience URL and the SPNameQualifier
are the entityID, and the response is the AssertionConsumerService
Location.  I'd like the response URL to trigger a specific set of
attribute release rules, in case we need to serve two different
populations for Marketo (it isn't campus-wide).

If I make two entityID's, one has to not be http://saml.marketo.com/sp,
then the Subject and Conditions stanzas of the response have the new
entityID for the Audience and SPNameQualifier, which seems to cause a
problem.

This is all over IDP-initiated SSO.  So I could make a separate entityID
target in the metadata for each site that overwrites the Audience and
SPNameQualifiers if I knew how to do that.  Or I could use the
http://saml.marketo.com/sp entityID, which seems to work, then maybe
pull the ACS Location endpoint URL in use out of some subContext of the
profileContext using a scripted attribute filter PolicyRequirementRule?

-Eric Hattemer

University of Southern California