Making the SAML sign-on work with strict IdP's, like Microsoft ADFS. The issue was that we were sending a SAML Request with a Redirect binding, while our metadata advertised a POST binding. The Citrix login also work.s