IDP initiated binding with APM as SP

Thanks for a good answer, it led me in the right direction.

Unfortunately I do not have an IDP configured for IDP initiated to test with. But I test using my existing SP and my existing External IDP Connector, using unsolicited POST containing SAMLResponse and RelayState. This should simulate how the IDP-initiated workflow would look for the SP.

I use Postman and POST directly against my SP's ACS service with RelayState and SAMLResponse set up more or less the same as how SP initiated request to ACS are made. I did modify the SAMLResponse a bit, including removing the InResponseTo attributes.

I had som trouble with signing, encoding/escaping, etc, but resolved those. But my ACS then failed SAML Auth. After some searching I found that the problem was that I have multiple SAML IDP Connectors bound to my SP, and they are matched using the landinguri

%{session.server.landinguri}

I edited my SP to remove all but one SAML IDP Connectors and could then remove the matching rules. With this setup it all worked.

However, I would still like to configure my SP with multiple IDPs (and to do so I must use matching rules).

Any idea for how to do make this work?

As I understand it, the simplest solution would probably be to make sure

%{session.server.landinguri}