why/how is IdP login page displayed for unknown Service

[Peter Schober]

* Nate Klingenstein <ndk at signet.id> [2021-07-15 22:38]:
> The only way you'll know for sure is by further interrogating them
> as to what they're doing, and looking at the actual HTML and HTTP
> exchanges should be more informative than just looking at the
> rendered page.

"SAML Tracer" (browser extension) to the rescue.

Also, make sure your IDP web server has all the options set that
prevent its pages from being included within (i)frames anywhere.

-peter