SAML1

[Rod Widdowson]

> OK, but I don't understand why the IDP work with SAML2 and not SAML1 if
it's
> an httpd conf ?

SAML2 supports encryption of the Assertions which flow from the IdP to the
SP.  This makes it safe and secure [*] to push them via the browser. 
SAML1 doesn't.  This means that by default the SAML1 flows require that the
SP contact the IdP via a TLS secured back channel in order to query the
attributes.

It is this connection which is failing.  This is almost certainly this is
because it is the IdP which has to judge the security of the connection, not
HTTPD (the IdP knows what the SP certificate looks like and HTTPD doesn't).

This extra step of configuring the IdP for backchannel activity is always
fraught, before you even introduce putting HTTPD in front of it (which of
course squares the complication).  That’s why, for many people stopping with
SAML2 is the best bet.  

[*] for some definition of safe and secure.  All these things are a tradeoff
between the various weaknesses in each of the different mechanisms.