certificate name was not acceptable

[Cantor, Scott]

> A particular IdP integration is causing some issues for us. After the user
> enters their credentials on the IdP, they are returned to our hosted solution.
> Following error is logged in shibd_warn:

There are really two issues, one the real one, and one a consequence of the first.

The real issue is that they're using SAML 2.0 here but their IdP isn't releasing any attributes to you. That's an error on their side. A related problem is that the metadata they give you improperly indicates they support SAML 2.0 attribute queries. That is rarely needed, and in this case, they don't support it. Their endpoint in the metadata is configured with a certificate with an improper hostname, so the connection fails. (Think of what your browser does when you hit an SSL site and the name doesn't match.)

So basically they should elide the endpoint from their metadata, and then fix their attribute release issue.

-- Scott