SubjectConfirmationData - incorrect recipient

[Cantor, Scott]

> This is the request message from the SP:

Which says to use POST. So any response with a different binding is not valid. And delivering a response that says it's to be sent to the POST endpoing but sending it to a different endpoint is not allowed.

> The IDP is not a Shibboleth installation – it is provided by a third party
> commercial vendor.

I don't think anything like that would be supporting SimpleSign, that never got any uptake. The chance is very slim, like first time in 12 years slim.

But i don't know what more you're looking for. The IdP is broken and needs to be corrected.

-- Scott