Suffering Mightily Under the Iron Fist of PKI

So. The 2008 ADFS Step-by-Step guide.  (Thank you Matt for the link, once again.)

The ADFS part?  Fairly easy, if you don't count the trailing '/' in the definition of the application URL that, as it turns out, really really matters! and cost me 30 minutes of head-scratching right at the end after I'd figured out everything else.

Now, the PKI (read: "everything else") part? Took me the whole fracking weekend to get it right. I don't know if the docs are only 90% of the way there, or if I just wasn't reading carefully enough. JoeK does not kid when he tells you that "publicly-signed PKI certificates are the key to salvation when configuring ADFS."

I shall now officially dub the last 3 days: "The ADFS Weekend of Repeated and Abject Failures, though Happily Everything Ended Well."  Too long for a t-shirt slogan, but otherwise captures things quite nicely.