Problem getting shibb 2.3.5 to work with workday

[Cantor, Scott]

> I have set it up and am getting in a login redirect loop. For each
> redirect I see that another instance of the _idp_authn_ic_key cookie has
> been dropped.

I doubt the IdP has anything to do with the issue, it's probably looping because it's handling a failure on the SP end by starting over again.

What specific SAML features do they support, and how do those map to the default profile handler behaviors in the IdP, which changed in 2.3? My guess is they don't support signing the assertion instead of the response, perhaps.

-- Scott