Encryption-less SP to auth against encryption-mandating IdP?

[Cantor, Scott]

I think you're also misunderstanding that saying the "SP" requires something in particular but then talking about deploying mod_shib because the "SP" already has Apache is a bit odd. An SP is the SAML implementation, that's what mod_shib is part of.

If you're talking about putting *this* SP in front of the application itself, you would need to get rid of it's SAML implementation and be able to change the application to consume the security data from the web server where the Shibboleth SP puts it.

If that were possible, then you wouldn't need a proxy, the SP can handle signed requests and encryption, obviously, and directly handle that IdP.

I was assuming from your description you controlled neither end.

-- Scott