<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<span style="font-size:11.0pt"><o:p></o:p></span>
<blockquote type="cite"
cite="mid:E7BB1DDB-2C8B-4F6A-9749-11BA2DE9C67A@mssm.edu">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Therefore,
I’m looking at SAML debugging tools which I can use to
isolate problems that may arise, like
<a href="https://samltest.id/" moz-do-not-send="true">SAMLTEST.ID</a>.
However, I cannot use <a href="https://samltest.id/"
moz-do-not-send="true">
SAMLTEST.ID</a> itself, as my site is in our Intranet, and
only accessible to clients on site or connected via a VPN.</span><br>
</p>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>Unless you are doing back-channel (and you almost certainly are
not), the SP does not need to be reachable by the IdP directly,
nor vice versa. They don't communicate directly, messages are
passed front-channel via the user's browser. As long as the user
sitting at the browser can reach both, then that's fine. In other
words, as long as a user sitting on your intranet or VPN can reach
both your internal SP and SAMLTEST.ID on the internet, that
works. However, if your intranet or VPN restricts traffic
outbound to the internet from the users' computers, then yeah,
that would be a problem.<br>
</p>
<br>
</body>
</html>