Shibboleth SP with Novell NAM IDP

[EMP]

I'm trying to get a Shibboleth SP 2.4.3 working and talking to a Novell 
Access Manager 3.1.4 IDP.

To do this i've setup the SP to protect a resource (/secure) and the 
following -

<SSO entityID="https://idp.xxx.com/nidp/saml/metadata">
SAML2 SAML1
</SSO>

<MetadataProvider type="XML" 
file="C:\opt\shibboleth-sp\etc\shibboleth\xxx.xml"/>

Running a shibd -check reports no issues, however mdquery will only work 
when I add the -saml11 switch to it, ie mdquery.exe -e 
https://idp.xxx.com/nidp/saml/metadata -idp -saml2 -saml11

When I access the /secure URL I get an error - None of the configured 
SessionInitiators handled the request error and the shibd.log shows the 
following

dispatching message (default/Login::run::SAML2SI)
2012-09-24 20:40:50 INFO Shibboleth.SessionInitiator.SAML2 [1]: unable 
to locate SAML 2.0 identity provider role for provider 
(https://idp.xxx.com/nidp/saml/metadata)

The Metadata is loaded fine in the shib.log.

Leads me to believe the IDP Metadata is screwy, so looking at that I see -

<md:IDPSSODescriptor ID="id-CRd71.mwwwCOjc65XWDmkyWvEc" 
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.0:protocol 
urn:oasis:names:tc:SAML:1.1:protocol">
  <md:KeyDescriptor use="signing">
  <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  <ds:X509Data>
  <ds:X509Certificate>cert data removed from here before 
posting</ds:X509Certificate>
  </ds:X509Data>
  </ds:KeyInfo>
  <md:EncryptionMethod 
Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc" />
  </md:KeyDescriptor>
  <md:KeyDescriptor use="encryption">
  <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  <ds:X509Data>
  <ds:X509Certificate>cert data removed from here before 
posting</ds:X509Certificate>
  </ds:X509Data>
  </ds:KeyInfo>
  <md:EncryptionMethod 
Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" />
  </md:KeyDescriptor>
  <md:ArtifactResolutionService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" 
Location="https://idp.xxx.com/nidp/saml/soap" index="0" isDefault="true" />
  
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat> 

  
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat> 

  <md:SingleSignOnService 
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
Location="https://idp.xxx.com/nidp/saml/sso" />
  </md:IDPSSODescriptor>

I'm guessing the IDP Metadata is wrong somehow. Either that or my config 
is wrong but i'm not sure that is the case. Has anyone got any ideas 
towards this, or any ideas how to get the SP working with a Novell NAM IDP?

- Liam