Shibboleth IdP 4, SAML proxying and SimpleSAMLphp proxy breakage?

[Cantor, Scott]

I did verify (both while writing the code and just now) that the rule in SAML is to add the "latest" IdP at the end of the list of AuthenticatingAuthority elements.

I can't say I have any clear idea what on earth they're doing with the name qualifiers but it sounds like maybe they're looking at the elements in the wrong order.

-- Scott