Assuming Shibboleth IdP Windows Installer users are going to go the route of using Active Directory (AD) as the LDAP source for their Shibboleth IdP, then it would be useful if idp.attribute.resolver.LDAP.searchFilter= used sAMAccountName rather than uid. This appears to already happened for idp.authn.LDAP.userFilter= already.
Proposing an improvement to replace this;
with this as part of either the Windows MSI installer, or other Shibboleth installer (The discussion with Rod and Scott also mentioned whether this should be considered in a cross-platform context.)
- Jon Agland, UK federation team, Jisc