Generating SAML attributes and calculations in variable assignments

I'm assuming you're referring to eduPersonTargetedID. The definition uses the word "opaque", which doesn't mean encrypted. The definition does imply, however, that the value should reveal no information about the user. That rules out hex-encoding. A hash could work here, but the definition also implies that it should not rely on the username, nor necessarily change when the username changes, which a hash surely would.

It's a little vague as to how the value is actually constructed, and just Googling around I see a few different variations of formatting. Are you certain that a SHA256 hash will work here, per the InCommon specification?

As for the VPE assignment, you need a semicolon between the commands:

binary scan [mcget session.ad.last.attr.sAMAccountName] H* encstr; return $encstr