Different Attribute Filters for different ResponderIds

[Daniel Lutz]

On our special IdP, we need to apply different Attribute Filters
for different ResponderIds (i.e. issuers of assertions).
That is, independently of the SPs, the IdP should apply a specific set of
of filter policies depending on the issuer of the assertion.
(For example, for ResponderId 'A', the attribute 'mail' should be released
to any SP requiring it, but for ResponderId 'B', the attribute 'mail' should not
be released at all).

To my knowledge, only a single Attribute Filter service is available (and
configurable by a set of attribute filter policies), and it's not possible
to define multiple Attribute Filter services and let the IdP choose the filter
service to use depending on some criterion (e.g. the ResponderId).
(And the "AttributeIssuer*" matching rules available in IdP 2 seem to
have been deprecated in IdP 3.)

May we need to define some kind of proxying Attribute Filter service, which
calls a specific Attribute Filter service matching the criterion?
Do you have some other idea how we can solve this?


Daniel