IdP v4 SAML Authentication Proxy Questions

[Nate Klingenstein]

> >    1)  Are unsolicited SSO requests supported?
> 
> No.

I'll add something to the Wiki mentioning that, assuming I can use the helpful Swedish IdP that Peter mentioned.

> I would assume from that the SC is invalid. Client address perhaps? I don't know what all the errors actually look like. Sounds like it decrypted if it logged the assertion's ID.

Good idea and good guess.  It's using an outbound AWS IP rather than the real client IP because the proxy IdP sits behind a load balancer that has issues with X-Forwarded-For.  I'll fix that.

            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData Address="172.31.12.208"
                    InResponseTo="_7cd706ba91bc988d3085b3c9f8fd3872"
                    NotOnOrAfter="2020-10-05T22:39:19.697Z" Recipient="https://54.202.73.164:8443/idp/profile/Authn/SAML2/POST/SSO"/>
            </saml2:SubjectConfirmation>

Thanks so much,
Nate.