You need to check the configuration of the idp, that's where the restriction is coming from ( not the code). You don't say whether it's v2 or v3 but the file to look at will be called relying-party.xml (v2) or metadata-providers.xml (v3) Rod Sent from my iPad