IdP: Returning emailAddress as NameId in SAMLResponse Assertion

[vyal2k]

Hi,
 I am trying to have IdP return email address as the NameId in the Assertion (in response AuthnRequest). But the returned nameId value (in decrypted Assertion) is some sort of code "_3ad95a453140ebc4894b5777f58096e2" instead of the authenticated user's email address (in LDAP) that i was expecting.

Here is attribute-resolver.xml at IdP:
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="email" sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP" />
<resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
    </resolver:AttributeDefinition>
    
Here is attribute-filter.xml at IdP:
<afp:AttributeFilterPolicy id="citrixShareFile_nameID">
<afp:PolicyRequirementRule xsi:type="basic:ANY" />
<afp:AttributeRule attributeID="email">
<afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>
</afp:AttributeFilterPolicy>

SP configuration at IdP: <SPSSODescriptor> includes:
<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

And the AuthnRequest contains:
<saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>

Please let me know how to have IdP return authenticated user's email address to the SP.

Thanks,
Vasu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131121/fbab6487/attachment-0001.html