SAML - SP and IDP both on APM

Use different dns name for your sp and idp virtual servers. The problem is probably the mrhsession cookie you get when you access the sp being sent again to the Idp, that makes think APM that the session is already in place.