login_hint from shibboleth sp to azure idp

[Cantor, Scott]

> You got me thinking of a related approach - update the
> metadata to send the 302 to a site I control where I could add
> the hint and use another 302 to forward it on - hacky but
> probably doable.

Generally invalid because of the Destinatioon attribute, but technically that doesn't have to be checked if the request isn't signed. You'd run into implementations that would though.

-- Scott