For the benefit of the archive... It's all coming back to me from when I set this up with the old IdP. I had to use a frame-busting script in between their SP and the IdP to relay the authn request along. -- Scott