The PrincipalName attribute definition in the resolver will pull the value in, but that's not really advisable, there is no standard way to represent that in SAML. You would use that to query a directory or database of IDM data to pull the real information to pass to SPs, not pass a username directly. -- Scott