Use multitenant AAD for SAML flow

[Cantor, Scott]

>    Is there some way in which we can let Shibboleth skip this check?

No, that's not approriate behavior in a pretty fundamental way, the identity of the systems is what drives everything in the code and configuration and it's a feature rather than an accident that this code for proxying actually remembers who it issued a request to, vs. the looser behavior I built for the SP.

That sounds to me like a significant and serious bug in whatever this is (I am assuming it's something to do with Microsoft).

-- Scott