Encryption-less SP to auth against encryption-mandating IdP?

[Cantor, Scott]

Neither our IdP nor SP function by design as proxies, using something like SimpleSAML.php or Satosa tend to be better choices. You *can* do it (using apache and mod_shib in front of the IdP for authentication), it's just not well integrated. The IdP will be gaining some proxy capabilities in the future, though it's so foreign to the brain of some of us (ok, me) that I don't know if it will ever be on par with those solutions.

But proxying to deal with an IdP not toggling a simple setting like this is insane. That's a business problem to solve with a meeting and somebody in charge simply stating what has to happen, not a technical problem to solve by deploying more software.

-- Scott