IDP 4.3 and non URL SP entity IDs

[Cantor, Scott]

>  Standards compliance, and honoring limitations on proxying that no SP in the
> world is probably populating.

On that subject, when we first started implementing proxying and I noted that these restrictions were supported in SAML and we were planning to honor them (in both directions, e.g. IdPs indicating that proxying to other SPs should not be permitted), the response I got from an SP proxy operator that shall remain nameless was that "they weren't really proxying", despite it being literally a textbook case of it.

People are fascinatingly good at pretending rules don't apply to them if they're suddenly subject to them.

-- Scott