Need help troubshooting: Unable to locate satisfiable bearer SubjectConfirmation in assertion

[joel_emery@archibus.com]

In an earlier post I asked how to troubleshoot the error ' An issuer was supplied that conflicts with previous results'.  Scott identified the problem as the NameID Format.  They have corrected their IdP. 

They are now reporting that after logging into the IdP they see the error: 'Unable to locate satisfiable bearer SubjectConfirmation in assertion'.

In the SAML response below the SubjectConfirmationData/Recipient seems to be the ACS and not the entityID.  Is this right?

Some details: 
Platform: Windows Server 2008 R2 64-bit
Shibboleth version: 2.5.2 64-bit
IIS version: 7
Using wildcard certificate: *.domain.com (for instance: *.archibus.com)
SSL host headers defined using: 
appcmd set site /site.name:"Default Web Site" /+bindings.[protocol='https',bindingInformation='*:443:my.domain.com']

Here is the SAML response from my last post (the NameID Format has since been corrected, but I don't have an updated SAML response with the corrected Format): 

<samlp:Response 
        ID="_4101bc68-0226-4ebc-a61e-e4cacb2aae34"
        Version="2.0" IssueInstant="2013-11-26T20:22:44Z"
        Destination="https://my.domain.com/Shibboleth.sso/SAML2/POST"
        xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.bigcorp.com/SAMLService
    </saml:Issuer>  
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
    </samlp:Status>
    <saml:Assertion 
            Version="2.0"
            ID="_d012d006-b59f-4e87-8df7-e82dad1cefed" 
            IssueInstant="2013-11-26T20:22:44Z"
            xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml:Issuer Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">https://idp.bigcorp.com/SAMLService
        </saml:Issuer>
        <saml:Subject>
            <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">1234567890</saml:NameID>
            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData
                    NotOnOrAfter="2013-11-26T15:27:44Z"
                    Recipient="https://my.domain.com/Shibboleth.sso/SAML2/POST" />
            </saml:SubjectConfirmation>
        </saml:Subject>
        <saml:Conditions 
                NotBefore="2013-11-26T20:20:44Z"
                NotOnOrAfter="2013-11-26T20:24:44Z">
            <saml:AudienceRestriction>
                <saml:Audience>https://my.domain.com</saml:Audience>
            </saml:AudienceRestriction>
        </saml:Conditions>
        <saml:AuthnStatement 
                AuthnInstant="2013-11-26T15:22:44Z"
                SessionIndex="bdd6bb36-b0d7-4eed-87da-6e525645731d"
                SessionNotOnOrAfter="2013-11-26T15:27:44Z">
            <saml:AuthnContext>
                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password
                </saml:AuthnContextClassRef>
            </saml:AuthnContext>
        </saml:AuthnStatement>
    </saml:Assertion>
</samlp:Response>

Joel Emery