Hi, Rhett.
The template you need is packed inside `/opt/gluu/jetty/identity/webapps/identity.war`
It will be easier to just extract it from the exploded WAR inside `/opt/jetty-9.4/temp` dir when "identity" service is running. Here is example (note that path in your container will be different due to it having a dynamically generated component in it; you'll need to find out it on your own):
```
# jar -xf /opt/jetty-9.4/temp/jetty-localhost-8082-identity_war-_identity-any-16630717722781302559/webapp/WEB-INF/lib/oxtrust-configuration-4.2.3.Final.jar META-INF/shibboleth3/idp/saml-nameid.xml.vm
```
The command above will create `META-INF/shibboleth3/idp/` dir structure inside your working directory, and will extract `saml-nameid.xml.vm` template in there.
You can see other templates inside this JAR like this:
```
jar -tf /opt/jetty-9.4/temp/jetty-localhost-8082-identity_war-_identity-any-16630717722781302559/webapp/WEB-INF/lib/oxtrust-configuration-4.2.3.Final.jar | grep -i .vm | grep -e '\.vm'
```
After you'll deploy this file under `/opt/gluu/jetty/identity/conf/shibboleth3/idp`, make sure it's readable for "jetty" user (file permissions).
Hope this helps.