Requested/Supported Principals

[Cantor, Scott]

Also, in your specific case, writing your own X509 flow with a different 
bean definition at the end in place of ValidateX509Certificate should work 
around the issue for now.

The whole problem is in this two line function:

protected Subject populateSubject(Subject subject) {
    subject.getPrincipals().add(
      ((X509Certificate) 
certContext.getCertificate()).getSubjectX500Principal());
    subject.getPublicCredentials().add(certContext.getCertificate());
    return subject;
    }

The bug is that "subject" there is coming from the base class and that 
Subject already has the flow-defined custom Principals in it that you're 
trying to avoid having in there.


If you create a version of that class that builds its own Subject or 
explicitly removes Principals from the input parameter, I think it will do 
what you want.

-- Scott