configuring idp to release the "remote_user" as nameid

[Peter Schober]

* David Mansfield <shibboleth at dm.cobite.com> [2013-06-25 16:16]:
> I'd like the users "remote user" as a saml22 persistent nameid

Also note that the kerberos principal name supplied via REMOTE_USER
fails most or all of the properties of a persistent name identifier
(namely: persistent, opaque, targeted, revocable, non-reassignable):
https://wiki.shibboleth.net/confluence/display/SHIB2/NameIDAttributes
and fails the SAML spec (8.3.7) in that regard:

  "Persistent name identifiers [...] MUST be constructed using
   pseudo-random values that have no discernible correspondence with
   the subject's actual identifier (for example, username)"

SAML2 defines "urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos" for
kerberos principal names (section 8.3.5), so that would be more
appropriate.

Unless you meant to use the kerberos principal only as an /input/ into
one of the StoredId or ComputedID data connectors, to produce a proper
persistent NameID from it (which I'd recommend).

Finally, you'll then have to take care to release this NameID format
instead of the transient one, see the very end of
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier
for a start.
A simple way is the mentioned precendence list or to have filter rule
that releases the persistentId to whomever you want which also has a
DenyValueRule for transient.
-peter