[someone13]

This is part of what makes this class of bug so bad; it's not something you can "fix" at the IDP without doing exactly this. The issue occurs when a Service Provider (SP) is misconfigured, and in many cases the IDP doesn't actually get any sort of feedback that would let them detect the issue.

[mc32]

Is there a way to audit that kind of misconfiguration?

[tptacek]

Yes, tediously, with auditors who understand SAML and the (very informal) literature on SAML attacks. Hence, the concern.