alternate attributeSourceIDs for a given nameid format

[Cantor, Scott]

There is a second trick I've used, arguable that it's any more palatable, but it allows you to override the entityID of an IdP-initiated SP.

Even if Concur checks the audience restriction condition (that's a big if), you can fool them by using an alternative entityID in your requests into the IdP and then add back their real entityID as an additional audience using the profile option that populates additional audience values. So they get the real entityID in the assertion but you can can trigger policy on the fake one.

-- Scott