> Just in case, I've tried analyzing the certificate, and there is a statement: > X509v3 extensions: > X509v3 Subject Alternative Name: > DNS:zimbra.ntin.edu.tw <http://zimbra.ntin.edu.tw> , > URI:https://my.host.name/shibboleth Try adding extractNames="false" into the CredentialResolver. -- Scott