Error message: Client address x.x.x.x invalid for session ... bound to y.y.y.y

[Cantor, Scott]

No, it's not causing the error you're talking about, but the ability to disable address binding is provided by the idp.session.consistentAddress property as documented [1].

IMHO running an IdP with unbound sessions is a really, really bad idea but that's not my decision. I really wish we had a metadata signal for such IdPs though, because I sure as heck wouldn't accept their assertions.

-- Scott