IDP 4.3 and non URL SP entity IDs

[Cantor, Scott]

> Scott, I'm failing to understand the risk of setting ignoreScoping to true if there
> is one.

Standards compliance, and honoring limitations on proxying that no SP in the world is probably populating.

> And what are the ramifications of passing them through vs. having the IdP
> generate its own, other than the obvious issue with Microsoft that Roberto
> reported?

It's not a passthrough. The contents of the request's Scoping element will depend on whether the original request had one and what was in it. ProxyCount has to be decremented if set (or enforced if it's zero), and the RequesterID list is supplemented by the latest one.

I piggybacked on the ignore flag to provide a way to prevent the IdP creating its own element if there wasn't already one to supplement, and this was why.

-- Scott