So with Simon's help I eventually managed to get the acceptance tests to run this morning.  I got seven failures:

Three instances of this:
_StringException: Traceback (most recent call last):
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/runtests.py", line 571, in run_test_script
    exec self.code in self.context
  File "/home/jtait/src/canonical-identity-provider/identityprovider/tests/acceptance/consumer/return_private_teams.py", line 52, in <module>
    login_from_redirect()
  File "/home/jtait/src/canonical-identity-provider/identityprovider/tests/acceptance/shared/helpers.py", line 249, in login_from_redirect
    log_in = pages.LogInFromRedirect()
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/u1testutils/sst/__init__.py", line 74, in __init__
    self.assert_page_is_open()
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/u1testutils/sst/__init__.py", line 98, in assert_page_is_open
    self.assert_headings2()
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/u1testutils/sst/__init__.py", line 157, in assert_headings2
    self._assert_elements_text('h2', self.headings2)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/u1testutils/sst/__init__.py", line 148, in _assert_elements_text
    ', '.join(expected_texts), ', '.join(elements_text))
AssertionError: Expected elements texts: Log in, Are you new?
Actual elements texts: Log in to Ubuntu Single Sign On, Are you new?


Two instances of this:
_StringException: Traceback (most recent call last):
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/runtests.py", line 571, in run_test_script
    exec self.code in self.context
  File "/home/jtait/src/canonical-identity-provider/identityprovider/tests/acceptance/root/link_logo.py", line 25, in <module>
    wait_for(assert_title, 'Home | Ubuntu')
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 134, in wrapped
    return func(*args, **kwargs)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 750, in wait_for
    _wait_for(condition, False, _TIMEOUT, _POLL, *args, **kwargs)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 727, in _wait_for
    _raise(error)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 118, in _raise
    raise AssertionError(msg)
AssertionError: Timed out waiting for: assert_title
Error during wait: Title is: u"The world's most popular free OS | Ubuntu". Should be: 'Home | Ubuntu'


Those look to be out-of-date tests.  Two were related to SReg opt-out and disabled fields, though:

_StringException: Traceback (most recent call last):
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/runtests.py", line 571, in run_test_script
    exec self.code in self.context
  File "/home/jtait/src/canonical-identity-provider/identityprovider/tests/acceptance/consumer/SREG_opt_out.py", line 78, in <module>
    assert_element(id=required_sreg_element, disabled="disabled")
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 1045, in assert_element
    _raise(msg)
  File "/home/jtait/src/canonical-identity-provider/.env/local/lib/python2.7/site-packages/sst/actions.py", line 118, in _raise
    raise AssertionError(msg)
AssertionError: Could not assert element exists


Now, I'm not that familiar with SST or the acceptance tests, but I had a dig around and it looks like there's a list of fields in a CSV file that are expected to be disabled, and the test is effectively looking for an element in the page with the specified id and the disabled attribute, which it's failing to find.

I haven't been able to reproduce this with in-browser testing, however, nor have I managed to determine which element it's failing to find - trying to run just the failing tests with fab acceptance is getting past that test and failing later on with an incorrect e-mail address in the returned SReg data.  I did notice a screenshot of the failure, though, showing all the checkboxes enabled.

I suspect it's a result of a misconfiguration on my part - perhaps the trust root doesn't exactly match - but it did also highlight that we haven't added AX to the example consumer view.  I'm inclined to tackle that in a separate MP.

Oh, and I also uncovered a bug in the migration script, when a user has no ax or sreg keys in their approved_data, so I fixed that.