Your IdP is using an RSA KeyTransport algorithm that fell many years ago and has been on the algorithm deny list for probably 10 or so years. The libraries just exclude support for it, so the code doesn't know it's been blocked, it just knows it can't process the EncryptedKey element and get a result. -- Scott