Ian noted privately that one oddity about the metadata you had was the EncryptionMethod element. I don't know of the IdP using that, or doing anything but ignoring it, but you might try removing it. If that fixes it, please file a bug. -- Scott