Debugging SAML to OIDC ACR proxying

[Scott Cantor]

I would think there'd be a logging category for message logging like there is in OpenSAML, but if not that's a bug/gap.

Having said which, the main issues with this are the Principal type mismatch issues that come up across the boundary because all of the preliminary stabs at trying to solve for all this weren't designed properly and it won't get cleaned up until V6 and will probably require breaking changes.

The OpenID ACR principal class != the SAML one, as you probably know, and any mappings happening have to address that. A Subject produced by the RP login flow has to contain both types of Principals or one or the other protocol outbound won't be able to work right in terms of supporting particular imposed requirements for a particular ACR.

-- Scott