passing correct nameid after shib3 upgrade

[Cantor, Scott]

> Can someone show me how to pass the correct nameid?

The rules for NameID Format selection are the same as in V2. The format selection process is also very explicitly documented, so I simply suggest you look at them and follow them as needed. [1]

In the case of O365, I would imagine that would entail its metadata being adjusted to include a NameIDFormat element. That is how you should have been doing it with V2.

If you are still using the attribute resolver to generate NameIDs in V3 using the deprecated NameID AttributeEncoders, then the problem is that it's defaulting to transient NameID selection because that's generated outside the resolver now and ends up taking over when there's no explicit format selection. I didn't quite realize that until I was writing this email, but that probably explains why so many people are getting this wrong. I'll add a note to the upgrade considerations page.

TL;DR: the attribute filter is not an appropriate mechanism for controlling formats and anybody doing that in V2 will have problems after upgrading.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration