Subject Alternative Names not found in c14n x500 flow

[Andrea Dolci]

Hello,
I'm having trouble extracting the SAN of type "othername" from the 
certificate used in the X509 Authn Flow during the c14n principal name 
creation.
The certificate gets accepted as the CA is trusted by the IdP, but no 
SAN seems to be retrieved.

With my current configuration the authentication fails as no suitable 
principal is found, however, if I use the CN as the principal I am able 
to complete the authentication (as expected), but I am also able to 
extract the SAN from the certificate in a ScriptedAttribute, using a JSR 
Script with code that closely resembles the 
X500SubjectCanonicalization.doExecute method.
I can provide the Script code if needed, but I am omitting it for now 
since this is already a lengthy email.

extract of conf/c14n/subject-c14n.properties
```properties
# Precedence is to check for a subjectAltName and then an OID RDN
# Comma-delimited list of subjectAltName type numbers
idp.c14n.x500.subjectAltNameTypes = 0,1,2,3,4,5,6,7,8
#idp.c14n.x500.subjectAltNameTypes = 0
## 0 should match othername type SAN

# Comma-delimited list of OIDS
#idp.c14n.x500.objectIDs = 2.5.4.3
# ^ CN
idp.c14n.x500.objectIDs = 1.3.6.1.4.1.311.20.2.3
## ^  userPrincipalName
```

extract of the certificate (opened  with OpenSSL)
```
X509v3 Subject Alternative Name:
                 othername: UPN::redacted at example.com
```

idp-process.log logs:
```
2025-05-09 09:56:29,422 - 10.11.9.43 - DEBUG 
[net.shibboleth.idp.authn.impl.X509AuthServlet:181] - Trust engine 
validated X.509 certificate
2025-05-09 09:56:29,434 - 10.11.9.43 - INFO 
[net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:187] - 
Profile Action ValidateExternalAuthentication: External authentication 
succeeded for Subject
/*...*/
2025-05-09 15:06:22,308 - 10.11.9.43 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:80] - 
Profile Action SelectSubjectCanonicalizationFlow: Selecting 
canonicalization flow c14n/x500
2025-05-09 15:06:22,330 - 10.11.9.43 - DEBUG 
[net.shibboleth.idp.authn.impl.X500SubjectCanonicalization:153] - 
Profile Action X500SubjectCanonicalization: Searching for subjectAltName 
types ([0, 1, 2, 3, 4, 5, 6, 7, 8])
2025-05-09 15:06:22,359 - 10.11.9.43 - DEBUG 
[net.shibboleth.idp.authn.impl.X500SubjectCanonicalization:163] - {} No 
suitable subjectAltName extension
```