resolver search filter

[Tom Poage]

IdP 3.3

We’ve conventionally used the following as search filter for the resolver:

(uid=$requestContext.principalName)

IdP 3.3 has in distributed resolver config:

(uid=$resolutionContext.principal)

I can guess, but am not immediately finding/seeing the distinction and why one would use one over the other, other than the distributed sample configuration files suggest using LDAP for authN prior to attribute resolution. We happen to delegate authN to CAS via ExternalAuthentication w/ Shibcas.

Which filter, if any, would be more correct for an external authenticator?

Thanks!
Tom.