On Wed, Feb 15, 2012 at 7:03 PM, Christopher Bland <chris at fdu.edu> wrote: > > If I have a SP-A and an IDP-A on the same machine, can I send a remote SP to the Remote_User handler of the IDP-A, which in turn validates based on a location protected by the SP-A? You've just described an IdP Proxy, which is discussed in the SAML Core spec. Tom