No candidate NameID formats

[Rod Widdowson]

> The latter 2 log lines are not clear to me, however. I.e., why
> specifying the format in an override leaves the IDP with an empty set
> and "nothing to do"?

This doesn't help you, but that reflects what the code is doing - the allowable NameIDs consist of the _intersection_ of the set
specified in the profile and the set specified in the metadata.  In order to get the set specified by the profile, the set specified
by the metadata has to be empty.

Rod