detected a problem with assertion: Unable to establish security of incoming assertion.

[Cantor, Scott]

> I know of no way to get that error without literally feeding it
> a header name from the client that collides.

Of course "client" in such a case could include a series of proxies where an instance of the SP is decorating a request internally that's then getting proxied over to another server running the SP, and with the wrong or naïve settings that isn't going to work.

-- Scott