Figured it out, but it's connected to some broader challenges in the config I have to address so it's not quite trivial to fix, you can track here: https://shibboleth.atlassian.net/browse/JSHIBD-24 -- Scott