Port number in SubjectConfirmationData

[Cantor, Scott]

> I’m not certain if this is a IdP configuration issue, or a vendor
> not properly following the protocol. 

My guess would be a load balancer issue. We have things somewhat indirected but normally that just comes from getRemoteAddr in Java, and that's not going to have a port in it generally.

But if a header were being proxied up to supply it via Forwarded, and it was "broken", I doubt we would have sanitized it, we'd just be taking what the web server handed us.

I am a little surprised Qualtrics cares. That's the check our SP implements in checkAddress and of course we turned that off by default years ago because of the lack of an end-to-end principle in modern networks, and I didn't think it was very common in other implementations.

-- Scott