Replacing IdP-provided attributes with those returned by an attribute authority

[Matthew X. Economou]

Dear all,

I have a Shibboleth SP that's part of a virtual organization (VO).  I
configured a SimpleAggregation attribute resolver to query our VO's
attribute authority:

    <AttributeResolver type="SimpleAggregation" attributeId="eppn">
        <Entity>https://aa.example.org/aa/shibboleth</Entity>
    </AttributeResolver>

Unfortunately, now attributes that are provided by both the user's IdP
and by our VO's AA are multi-valued:

affiliation:	member at myvo.example.org;member at example.com
eppn:	 	bob.dobbs at myvo.example.org;bob at example.com
mail:	 	shordurpersav at gmail.com;bob at example.com

Thankfully, REMOTE_USER only contains the VO-provided ePPN.

How do I ignore or filter out the IdP-provided attributes?  I want the
VO-provided attributes to replace anything provided by the IdP.

Best wishes,
Matthew 

-- 
"The lyf so short, the craft so longe to lerne."