I'm just in the process of setting that up right now! We're on the SP side, and the IdP lives inside an enterprise network and is not externally accessible. The

I'm just in the process of setting that up right now! We're on the SP side, and the IdP lives inside an enterprise network and is not externally accessible. The only problem is that it's a bit tricky to debug, since they won't give us VPN access at all. Debugging involves picking up the phone, asking our contact to do a login, and watching the log messages. Slow, but it works and it's a big enough contract that it's clearly worth it.