NameID in SP attribute-map

[Donovan, Aaron [USA]]

I'm having trouble exposing the NameID as an attribute using the Shibboleth SP v2.5.3 with Apache on Linux. 
My current configuration works with the External Authentication Handler, but not with SP/IdP sessions. 

I'm using PKI authentication on my IdP and setting the NameID with a format of urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName.

It's coming through in the SAML assertion as follows.

<saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509Subject" NameQualifier="https://idp.example.com/idp/shibboleth" SPNameQualifier="https://sp.example.com/shibboleth">CN=Joe Smith, L=Charlottesville, ST=Virginia, C=US</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="192.168.100.1" InResponseTo="_e7460db0d74be9406eda81328e517d9a" NotOnOrAfter="2014-03-14T15:07:04.714Z" Recipient="https://sp.example.com/Shibboleth.sso/SAML2/POST"/></saml2:SubjectConfirmation></saml2:Subject>

I'd like to expose the value as X509SubjectName and added the following to my attribute-map. I just want the DN, so I dropped the qualifiers in the formatter.

<Attribute id="X509SubjectName"
  name="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">
    <AttributeDecoder defaultQualifiers="true"
    formatter="$Name" xsi:type="NameIDAttributeDecoder" />
</Attribute>

However, the value isn't coming through. I see the following my transaction log.

2014-03-14 14:33:25 INFO Shibboleth-TRANSACTION [2]: New session (ID: _357018057275dc6e02e49a998bb34474) with (applicationId: default) for principal from (IdP: https://idp.example.com/idp/shibboleth) at (ClientAddress: 192.168.100.1) with (NameIdentifier: CN=Joe Smith, L=Charlottesville, ST=Virginia, C=US) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: _7df50588f3e9c9eb4140c3b5f582e8af)
2014-03-14 14:33:25 INFO Shibboleth-TRANSACTION [2]: Cached the following attributes with session (ID: _357018057275dc6e02e49a998bb34474) for (applicationId: default) {
2014-03-14 14:33:25 INFO Shibboleth-TRANSACTION [2]:    Attribute1 (1 values)
2014-03-14 14:33:25 INFO Shibboleth-TRANSACTION [2]:    Attribute2 (3 values)
2014-03-14 14:33:25 INFO Shibboleth-TRANSACTION [2]: }

What's really odd to me is that I'm also using the NativeSPBackDoor/External Authentication Handler. I use the same format, protocol, issuer, and nameid. In this case the X509SubjectName is populated as shown in the transaction log.

2014-03-14 14:38:59 INFO Shibboleth-TRANSACTION [3]: New session (ID: _5082b35ed3c645ddd454435f097a5baf) with (applicationId: default) for principal from (IdP: https://idp.example.com/idp/shibboleth) at (ClientAddress: ) with (NameIdentifier: CN=Joe Smith, L=Charlottesville, ST=Virginia, C=US) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: )
2014-03-14 14:38:59 INFO Shibboleth-TRANSACTION [3]: Cached the following attributes with session (ID: _5082b35ed3c645ddd454435f097a5baf) for (applicationId: default) {
2014-03-14 14:38:59 INFO Shibboleth-TRANSACTION [3]:    Attribute2 (3 values)
2014-03-14 14:38:59 INFO Shibboleth-TRANSACTION [3]:    Attribute1 (1 values)
2014-03-14 14:38:59 INFO Shibboleth-TRANSACTION [3]:    X509SubjectName (1 values)
2014-03-14 14:38:59 INFO Shibboleth-TRANSACTION [3]: }

Any ideas what's going on?

Thanks,
Aaron