Sorry, I didn't get notified that people were stil responding in this thread.
Yes, we did find a solution, which was to abandon the AIP method altogether and start using the "bootstrapper" method from the Admin Guide. See my comment above for more details.