The main point is that both the remote and hub SRX must have both the local and remote identity configurations.
And they are the reverse of each other and matching:
local hub = remote dynamic
local dynamic = remote hub
I have used both in the user@domain format for both sides when doing this but the check is they need to match on each side.