Forgot to add that this is why the documentation starts with checking /Shibboleth.sso/Status. That runs the handler extension and confirms that the most likely to be mis-installed part is working. You can't get a 500 from the SAML handlers if that one works. -- Scott