Summary: I want to use Salesforce as an identity provider to allow people to log into my app, regardless of what salesforce org they use.
I've created an app in PHP that uses SimpleSAMLphp to implement Single Sign-on as the Service Provider with Salesforce as the Identity Provider. In my Salesforce developer edition I've set it up as an identity provider, created a certificate, and created a Connected App configured with SAML and everything works with my PHP app. I can log in using Salesforce and the PHP app authenticates and returns attribute information for the user. Great.
Now I want to make this app available to users of other Salesforce orgs. So I created a managed package, included my Connected App, and uploaded it.
I created a second developer account to test this all out. Installed the package into the new account using the url, enabled access to it for the admin user. Great.
But here's the hangup...
When I try to log into my PHP app, it redirects me to the login screen for the 1st developer account (under which the connected app and package were initially created). Of course I can't log in there with the credentials for the 2nd dev account.
In theory I can see why it would want to do this... the Identity Provider configuration was created in that 1st developer account.
I've tinkered with adding an Issuer ID with the new dev account but when the PHP app tries to use it as an IdP, Salesforce errors out "Unable to resolve request into a Service Provider". Makes sense since this org is not configured as an IdP.
What piece am I missing here to make this app accessible to other orgs?