"Credential failed name check" ERROR

[Cantor, Scott]

> I haven't seen this error previously. This is early processing of incoming
> request; it seems to say checking a signed request failed, but refers to
> "Credential" failed, providing a CN that makes no sense either Cherwell or to
> me (subjectName='CN=ualaska.cherwellondemand.com
> <http://wellondemand.com/> ,OU=Domain Control Validated') Is that the CN
> from a certificate? Not a certificate in the SP metadata!

If it's not in the metadata then you know what the real problem is, same as it always is. The message is the usual "falls through into PKIX trust engine" result when the key isn't in the metadata. You're falling through from direct to indirect trust. SP 3 disables PKIX by default and IdP 4 will do the same.

-- Scott