SubjectDerivedAttribute problem

[Roman CHRENKO]

Hello.
I would like to use External Authentication plus setting remote username (signed by HMAC hash) into the saml2:Assertion as an Attribute.
External Authentication works fine, but I cannot achieve at IDP to add my String (with signed username) into the Assertion.
I found in the documentation that SubjectDerivedAttribute should be suitable for this case.
But it still doen't work. I think the problem could by in "principalAttributeName". Am I setting it correctly?
If no, how to do it correctly?

I added the definition of Attribute into "/opt/shibboleth-idp/conf/attribute-resolver.xml" (I would like to propagate it as X.509 "description" attribute, OID = 2.5.4.13):
      <AttributeDefinition xsi:type="SubjectDerivedAttribute" id="description" principalAttributeName="signedPrincipalName">
          <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:description" encodeType="false" />
          <AttributeEncoder xsi:type="SAML2String" name="urn:oid:2.5.4.13" friendlyName="description" encodeType="false" />
      </AttributeDefinition>
I added the definition of AttributeRule into the "/opt/shibboleth-idp/conf/attribute-filter.xml":
      <AttributeRule attributeID="description"> <PermitValueRule xsi:type="ANY" /> </AttributeRule>
There is a subset of my code in ExternalAuthnTestServlet:
boolean isAuthenticatedOK = myDoExternalAuth(EXT_AUTH_SERVER_URL, username, password);
if (isAuthenticatedOK) {
	String key = ExternalAuthentication.startExternalAuthentication(request);
	request.setAttribute(ExternalAuthentication.PRINCIPAL_NAME_KEY, username);
	String signedPrincipalName = this.getSignedPrincipalName(username); // returns token with username, time of expiration and HMAC hash
	request.setAttribute("signedPrincipalName", signedPrincipalName);
	ExternalAuthentication.finishExternalAuthentication(key, request, response);
	log(mn, "authn finished");
} else {
	request.setAttribute(ATTR_NAME_errorCode, "Incorrect username or password");
	request.getRequestDispatcher(JSP_NAME_loginPage).forward(request, response);
}

With this configuration I see no "description" (2.5.4.13) attribute in saml2:Assertion.
Could you help me, please?
Best regards,
Roman Chrenko