CAS-1468: X509SubjectAlternativeNameUPNPrincipalResolver

Microsoft (and others) support the embedding of a UserPrincipalName object as a SubjectAlternateName extension within an X509 certificate, allowing properly-empowered certificates to be used for network logon (via SmartCards, or alternately by 'soft certs' in certain environments). An X509UserPrincipalNameResolver class would make the use of CAS as a web single sign on solution incredibly easy for AD domains with an existing PKI infrastructure.
What happens with an IOException occurs? CAS would crash at this line because oct=null?