different assertions generated for WEB and ACTIVE clients

[Mauro Minella]

>> Whatever is being used for authentication ultimately isn't the IdP, so whatever it is, JAAS or otherwise, that is the documentation to refer to on how it generates the resulting principal names.

I'm using JNDI in server.xml as the guide suggests:
<Realm className="org.apache.catalina.realm.JNDIRealm" 
			connectionURL="ldap://localhost:389"
			authentication="simple"
			referrals="follow"
			connectionName="CN=adreader,CN=Users,DC=shibbdomain,DC=eduteamit,DC=net"
			connectionPassword="******" 
			userSearch="(cn={0})"
			userBase="CN=Users,DC=shibbdomain,DC=eduteamit,DC=net" 
			userSubtree="false"
			allRolesMode = "authOnly" />  

>> Since you have to configure authentication separately in the two cases due to limitations of the implementation, that presumably is causing the difference.
If I well understand, I'm using a different authentication mechanism for ECP and WEB, but I can't find what I should change in the IDP (attribute-resolver.xml? attribute-filter.xml? server.xml? login.config?), in order to get the same information in the ECP assertion. For example, the assertion generated for the active clients contains 
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth">_3eb107c6fa9d1f6b89ae99883d3381d6</saml2:NameID>

which is wrong, while the assertion generated for the HTTP clients contains
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="https://shibbidp.eduteamit.net/idp/shibboleth" SPNameQualifier="urn:federation:MicrosoftOnline">WcwzuD50xEmCH3xsfbbeEA==</saml2:NameID>

, which is right.

Thanks,

Mauro