Custom nameid getting released in version 2 but not version 3

[shibboleth655 at lewenberg.com]

In our Shibboleth version 3 environment we have these settings in 
saml-nameid.properties:

idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator
idp.nameid.saml1.legacyGenerator = 
shibboleth.LegacySAML1NameIdentifierGenerator

For specific relying parties we allow the release of mailNameID.

In our Shibboleth IdP version 2 environment we see that mailNameID gets 
released with an e-mail address even if the suVisibEmail attribute is 
NOT set to "world".

However, in our Shibboleth version 3.2.1 environment (which uses 
essentially the same attribute-resolver and attribute-filter files), 
mailNameID does NOT get released if the suVisibEmail attribute is NOT 
set to "world".

So, it appears that the attribute-filter suppressing an attribute that 
mailNameID uses suppresses mailNameID in version 3 but not version 2.

We can work around this, but I wanted to know if the logic for attribute 
release changed between 2 and 3 to account for this?


-------------------------

The AttributeDefinition's and the relevant attribute filter are below:

##########################
<resolver:AttributeDefinition xsi:type="ad:Simple" id="mailNameID"
                                   sourceAttributeID="mail">
     <resolver:Dependency ref="suLDAP" />
     <resolver:Dependency ref="mail" />

     <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" 
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="Simple" 
xmlns="urn:mace:shibboleth:2.0:resolver:ad" id="mail" 
sourceAttributeID="mail">
     <resolver:Dependency ref="suLDAP" />

     <resolver:AttributeEncoder xsi:type="SAML1String" 
xmlns="urn:mace:shibboleth:2.0:attribute:encoder" 
name="urn:mace:dir:attribute-def:mail" />

     <resolver:AttributeEncoder xsi:type="SAML2String" 
xmlns="urn:mace:shibboleth:2.0:attribute:encoder" 
name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" />
</resolver:AttributeDefinition>
##########################

In attribute-filter we have this line:

##########################
<AttributeFilterPolicy id="">
     <PolicyRequirementRule xsi:type="basic:AttributeValueString" 
attributeID="suVisibEmail" value="world"/>
   <AttributeRule attributeID="mail">
       <PermitValueRule xsi:type="basic:ANY"/>
   </AttributeRule>
</AttributeFilterPolicy>
##########################