<div dir="ltr"><div>Hi Mike,<br><br>It sounds like you're on the right track. It sounds like they're
looking at the <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier">NAME ID</a> (which is part of the subject in the SAML response from your IdP). <br><br>You need to <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/SAML2StringNameIDEncoder">setup a name id attribute</a> with the
data you want in your resolver
then add that (and deny the transient id one) in your attribute-filter.<br><br>Hope that helps!<br><br></div><div>Ian<br></div><div class="gmail_extra"><div class="gmail_quote"><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr"><div>I've configured my IdP to release the userPrincipalName </div><span style="white-space:pre-wrap"></span></div></blockquote><div dir="ltr"> <span style="white-space:pre-wrap">…</span> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr"><div>and, by default, the transientId is released as well:</div></div></blockquote><div>… <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr"><div></div>Is there any way I can create an attribute like the transientId that will include 'NAME_ID' (not sure what that is) that I can then pass to the SP with a consistent, easily recognizable value?</div>
</blockquote></div>
</div></div>