help with NameIDs

[Mark K. Miller]

Hello again,

So, I've heard that NameIDs are dealt with in a completely new way with 
IdP v3; I've even heard that it's 'waaaaay easier now.'  Sadly, the easier 
IdP v3 way has me completely flummoxed.  Everything I've tried has either 
had no effect whatsoever, or it's broken it completely and no NameID even 
gets created.  :-(

In v2 I did one of three things.  I either sent the default NameID, or I 
had a NameID of "unspecified" format that was sent, or I had a NameID of 
"persistent" format that was sent.  Both of the non-default NameIDs had 
their value assigned by using the value of the eduPersonPrincipalName 
attribute.  So, they were created in attribute-resolver.xml, and then one 
of them was always part of the release policy in attribute-filter.xml.

Now, for v3, I see in the wiki that there could be at least four files I 
have to use to get this done.  There's still the attribute-resolver where 
the ePPN gets created.  Then, there's the saml-nameid.xml file where the 
NameID generators are enabled and the NameIds are generated.

I'll say now it starts to get a little fuzzy; in reality, though, it 
started getting fuzzy somewhere in saml-nameid.xml.  Since I mentioned a 
NameID with persistent format, I've seen reference to setting the 
appropriate properties in the saml-nameid.properties file.  But, what 
properties would that be if I just wanted to assign an ePPN value to a 
NameID?

And, finally (?), since I mentioned a NameID with an unspecified format I 
think I've seen where that now requires something in the relying-party.xml 
file to trigger a profile configured with an appropriate 
nameIDFormatPrecedence property.

So, I think I've found references in the wiki for each specific part of 
handling NameIDs in v3, but I'm clearly missing something about how all 
these pieces 'fit together'.  Can anyone provide a pointer for an example 
that actually creates one (or two) NameIDs, and shows what's needed in 
each of the files above to get that done?  And, what about this stuff that 
needs added to the relying-party.xml file?  Can this new, version 3 bean 
to configure a profile to trigger the nameIDFormatPrecedence property just 
be added somewhere into an existing, legacy relying-party.xml file like 
you'd have after doing an upgrade?

Any guidance greatly appreciated!

Max