I'm using joget workflow enterprise, trying to get the SAML plugin to work with AD FS.  The actual SAML configuration is fine; I can see the authentication chain taking place.  However, on the final POST back to the plugin with the SAML response, I get this in joget.log:

INFO  13 Feb 2018 00:43:14 org.joget.apps.app.web.JsonResponseFilter  - Possible CSRF attack from url(/jw/web/json/plugin/org.joget.plugin.saml.SamlDirectoryManager/service) referer(https://my_adfs_server.mydomain.com/adfs/ls/) IP(123.123.123.123)

FWIW, my AD FS server is on a different domain from my joget server.  This isn't going to change.

I tried disabling CSRF checking per this article: Joget OWASP_CSRFTOKEN in V5 to no effect.

I can see where the message is generated in the source here: https://www.javatips.net/api/jw-community-master/wflow-consoleweb/src/main/java/org/joget/apps/app/web/JsonResponseFilter.java, which also suggests that maybe there's a whitelist I can use to allow this POST to take place, but I don't see where to set this.  Any ideas?