certificate name was not acceptable

[Nate Klingenstein]

Pete,

The default configuration of the SP will trigger it to request attributes from the IdP over the back channel if no attributes are received because ultimately the SP has no way of knowing whether the IdP wanted to be contacted.

If you're not trying to pass attributes over the back channel, either take the Attribute Authority endpoints out of the IdP metadata or remove this line from shibboleth2.xml:

        <!-- Use a SAML query if no attributes are supplied during SSO. -->
        <AttributeResolver type="Query" subjectMatch="true"/>

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAttributeResolver#NativeSPAttributeResolver-QueryAttributeResolver

If you are trying to pass attribute over the back channel, then yes, this needs to be further debugged, and that TLS connection can be failing for any number of reasons(one of the reasons we moved away from using the back channel in the first place).

Thanks,
Nate.

On Jun 13, 2013, at 19:40 , Pete Scott wrote:

> That seems strange to me, but all told it might be a non-issue; I’m not certain what is causing us to query for attributes—shouldn’t we be getting those back when the client is returned to us? What might prevent that from occurring?
>