IDP proxy approach with other NAMEID format than "transient"

[capmatch]

Hi,
i would like to setup a SP, IDP proxy and IDP with the following requirement:

1. The SP is able to issue an Authentication Request where it specifies that is willing to go to an IdP via an IdP Proxy
2. The IdP Proxy and SP does not have user accounts. All the account info is coming from IDP after authenticate in IDP. (and i don't want to have any authentication page in IDP proxy as well. just use it as relay)

Just follow the step in the follow page
https://wikis.forgerock.org/confluence/display/openam/SAMLv2+IDP+Proxy+Part+1.+Setting+up+a+simple+Proxy+scenario

the setup is working but with several questions

1. The sample must use "transient" nameID and fill in Transient user to "anonymous". So in the SAML response to SP will be "anonymous" whenever i would like to have valid NameID value (e.g cn, sn or email)

2. I tried to change the nameID to "emailAddress","unspecified" and remove the "Transient user" as blank. i found that the SAML response will be end at IDP proxy. But the IDP proxy don't forward or send the response to SP.

Any advice on that?

thx

capho