> a flag in their metadata as loaded by your IdP indicating their requests are supposed to be signed but they're not sending them signed This was the problem, for the archives. I suggested flipping AuthnRequestsSigned="false" in their metadata.