Custom nameid getting released in version 2 but not version 3

[Cantor, Scott]

On 8/3/16 8:17 PM, Klingenstein, Nate wrote:
>> Using one *inside* a rule has different implications.
> 
> The distinction is intelligible, but I can't trace it in my head.
>  "Makes no sense to me" is utterly "makes no sense to me".  I'm totally
> lost.

There are policy requirement rules and matchers (the things that are
meant to run against the values of an attribute being filtered). Some
things make sense in one place and some things make sense in another.
Using them where they don't make sense will produce results that don't
make sense.

A rule based on the value of a specific attribute is a policy
requirement rule. A rule based on the value of "the attribute being
examined" is a matcher.

The posted policy was fine. It was testing the value of one attribute to
decide whether to apply a policy containing rules about another
attribute. That's not an unusual thing.

> Correct me if I'm wrong, but debugging this would go:
> 
> "What attributes exist with values?"
> If it exists, "where did it come from and are these the right values?"
> If it's 'right' once it enters the resolver, "Which filter policies are
> in effect?"

Exits the resolver, not enters.

-- Scott