certificate name was not acceptable

[Cantor, Scott]

> Hmmm... can that be modified inside of an ApplicationOverride?

Sort of, but not if you're defaulting to it outside and then trying to turn them all off inside the override. The way all that stuff works breaks down when the default is "something" and the override wants to have "nothing" configured for one of those elements.

You might get it to work with an empty one of type Chaining:

<AttributeResolver type="Chaining"/>

Equally possible that will break and complain.

But that's all just symptom, and cluttering your logs, it's not the real issue.

> Thanks! Any thoughts on what might be the very best way to PROVE that to
> the client?

I wouldn't waste a lot of time on the certificate issue, the primary issue is the attributes not being released. Even if you got a query to work, you'd get back the same set of data, nothing. The release policy doesn't care whether it's a query or not.

(That assumes it's Shibboleth on the IdP, but I'm betting it is or the metadata you have wouldn't look like that or have query endpoints.)

-- Scott