send NameID claim without encryption in ADFS 2.0

Question

My Service Provider issues a SAML 2.0 AuthRequest with a NameIDPolicy tag like so:

<samlp:NameIDPolicy AllowCreate="true" 
       Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>

This causes ADFS 2.0 to correctly issue a SAML Response containing an encrypted NameID token created by a rule similar to the one found here

<NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">    
        MyeHAMeGLojBt7fcc2DQtntXXFka0kybkR42ZTitTUs=</NameID>

So far so good, however, my Service Provider doesn't seem to understand the encrypted NameID claim and is expecting it to be unencrypted while at the same time having the name-format as transient

As per this document, ADFS2.0 treats request for transient or persistent NameID formats as privacy scenarios (and hence the encryption)

So my question then would be: Is there any way to have ADFS 2.0 generate the NameID claim with Format=transient and an unencrypted NameID like so:

<NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">Joe</NameID> 

Answer 1

The way I've solved this goes like this:

1. Create a rule that extracts the UPN from AD
2. Create a transform rule that transforms the Incoming claim type: UPN to the Outgoing claim type: Name ID and choose the transient nameid-format from the 'Outgoing Name ID Format' dropdown

This causes AD to send the NameID in the format required:
<NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">Joe</NameID>

(I'll leave this question 'unanswered' for a while incase someone has a better solution.