Alan B,
its not about 'handing out' the User-Name...the current stuff now strips the User-Name
In FR 3.0.x prior to my query (and Alan D's fix), if you called 'cui' in default's post-auth (please note, *not* cui-inner, which still functions as advertised), User-Name was stripped regardless of whether a CUI was generated in the outer Access-Accept or not. IMO that was wrong. If anything, if it didn't generate a CUI, it should leave the User-Name well alone (which it does now).
anonymousID is one thin...but totally blank with no idea of realm etc is quite another. these sites dont support CUI , know about it or care :(
The fix Alan D has put in place means that *only* if a CUI exists in the outer Access-Accept, will User-Name be stripped. :-) Stefan Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238