OIDC: this user can't understand how to generate sub claim

[Cantor, Scott]

I guarantee you that any AttributeDefinition that encodes to "sub" is not producing any values, or it would work. So from that you can work backward to where the values should be coming from.

>    The DataConnector for subjectId is the plain DataConnector taken from
>  the conf/examples/oidc-attribute-resolver.xml

Sure, but where is it being applied as a dependency?

>    In this setup uid is defined as:
>    <AttributeDefinition id="uid" xsi:type="PrincipalName" />

Fine for testing, of course, but you should never deploy that. This is not an idle comment. I wouldn't even test that way, no matter how "simple" it seems. Subject IDs have to be stable and that could never be stable.

Anyway, where is "subjectId" actually being fed in as a dependency that will become "sub"?

-- Scott