passing correct nameid after shib3 upgrade

[Ryan Suarez]

Greetings,

It looks like our Office365 ECP is broken after upgrading from shib2 to shib3.2.1 IdP.  I upgraded by copying over the shib2 config to a clean host and running the shib3 installer.  I noticed that shib3 is passing an incorrect nameid, using this ECP test:
https://blogs.kent.ac.uk/unseenit/simple-shibboleth-ecp-test

Can someone show me how to pass the correct nameid?

This is what shib3 is passing (broken):
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="http://myidp.mydomain.ca" SPNameQualifier="urn:federation:MicrosoftOnline">AAhzZWNyZXQyOQiJqqs7TLZNJHfQhoGpllFD9FrGG53pQc9NRIsL+7vgu/WZWBnxptMSlyNmUI1ARX19xn43yEPgYNeuuR2q7403D+LfR8dThgXXZPIls6+4UWGA1wPfDktDHLelFXxUCxh02dx5</saml2:NameID> 

This is what shib2 is passing (correct):
<saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" NameQualifier="http://myidp.mydomain.ca" SPNameQualifier="urn:federation:MicrosoftOnline">nAxfpNobRk2vQZWtP4ug0Q==</saml2:NameID>

attribute-resolver.xml:
    <!-- O365: Use objectGUID for ImmutableID -->
    <resolver:AttributeDefinition xsi:type="ad:Simple" id="ImmutableID" sourceAttributeID="objectGUID">
        <resolver:Dependency ref="mydomain" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
    </resolver:AttributeDefinition>

attribute-filter.xml:
    <!-- Office365 -->
    <afp:AttributeFilterPolicy id="releaseMicrosoftOnline">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="urn:federation:MicrosoftOnline"/>
        <afp:AttributeRule attributeID="UserId">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="ImmutableID">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

relying-party.xml and metadata-providers.xml:
    <!-- Windows Azure AD -->
    <rp:RelyingParty id="urn:federation:MicrosoftOnline"
                      provider="http://myidp.mydomain.ca"
                      defaultSigningCredentialRef="IdPCredential"
                      defaultAuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport">
       <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
                                signAssertions="conditional"
                                encryptAssertions="never"
                                encryptNameIds="never" />
       <rp:ProfileConfiguration xsi:type="saml:SAML2ECPProfile"
                                signAssertions="conditional"
                                encryptAssertions="never"
                                encryptNameIds="never" />
    </rp:RelyingParty>

Office365 metadata:
https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml

regards,
Ryan Suarez