configuring idp to release the "remote_user" as nameid

[David Mansfield]

On 06/25/2013 10:23 AM, Peter Schober wrote:
> * David Mansfield <shibboleth at dm.cobite.com> [2013-06-25 16:16]:
>> The IdP sits behind apache with mod_auth_kerb doing http Negotiate
>> authentication and passing the REMOTE_USER to the IdP (running in a
>> tomcat web container).
> [...]
>> However, by default I was getting a transient nameId - some sort of hex
>> string, probably a session id or something.
>>
>> I'd like the users "remote user" as a saml22 persistent nameid, but I
>> can't figure out what the correct sourceAttributeId would be (if
>> any).
> I think it's
> https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverPrincipalNameDefinition
> (linked from
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute
> via
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier)
> -peter
I had already tried the below in attribute-resolver.xml (and released it 
it attribute-filter.xml):

<resolver:AttributeDefinition xsi:type="PrincipalName" 
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                               id="persistentId" />


and it isn't working for me.  Now there is no nameid at all in the 
assertion.  Does this have to have any AttributeEncoders or should it be 
embedded in another element?

Note: I have also changed the idp metadata in the <IDPSSODescriptor /> , 
which used to show only "transient" to :

<NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>

(and also in AttributeAuthorityDescriptor). Same change was made in the 
Idp metadata on the SP.  Both were restarted.

Thanks,
David