Analagous to the SP, there's a checkAddress setting on the SAML2.SSO profile configuration bean. https://wiki.shibboleth.net/confluence/display/IDP4/SAML2SSOConfiguration#55804373d9264505e7b248218c3ea26c3fd35a11 -- Scott