Validation problems with Proxied IDP (SAML flow)

[Cantor, Scott]

The address in a bearer SubjectConfirmation block is never the IdP's address, it's the client's address. If it doesn't match, then you're either operating in a NAT'd, proxied, otherwise broken network, or you're making life hard by trying to test in some artifical way (e.g., running a browser on the same host as an IdP or proxy and ending up with localhost on one of the legs.

p:checkAddress="false" on the SAML2.SSO profile bean will disable the check, documented in the Javadocs and at [1].

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP4/SAML2SSOConfiguration#55804373d9264505e7b248218c3ea26c3fd35a11