Cool, cool! Thanks for the thoughtful response. Will be interested to see your replay approach when you release it. We implemented it but have a different set of constraints than your service, of course.

If you want to look at another SAML implementation (perhaps to gather additional CVEs or for testing), we've open sourced our SAML bindings for Java: https://github.com/FusionAuth/fusionauth-samlv2