Pull the issuer into a dedicated attribute so its usable in a rule. https://wiki.shibboleth.net/confluence/display/SP3/AssertionAttributeExtractor -- Scott