Authentication Problem and TAI Help

We are using a TAI for custom user mapping from a certificate to Active Directory, and are experiencing this problem:

When any user (including JazzAdmins) opens a shortcut from their desktop (using internet explorer) to a project dashboard, they are prompted for their smart card. When they provide their credentials, they then get:

“Error!

You are not authorized to view this page.

Forbidden”

This page displays the project's name, and their user ID (NOT their user name as it should) at the top of the page.

If they click the link to CCM at the top of the page, they subsequently get:

“error: com.ibm.team.repository.web.client.internal.AUTHENTICATED_CONTRIBUTOR cannot be null”

OR, if they do a browser refresh, the displayed user name is changed from their user ID to their user name, and they are properly able to view the project’s dashboard without any further authentication.

But most people give up and complain that the link is broken before they will do a browser refresh.

Any ideas?

Also, does anyone have an example of how to implement a TAI with WAS?