One of the issues Jamie and I hit when testing ECP in Rippowan was the fact ipsilon-client-install failed to add the PAOS AssertionConsumerService to the SP metadata. The ECP transaction needs to know about this SP endpoint. If it's not defined you'll get a 500 error with a message concerning an unknown provider, like many errors the message percolated up from the bowels of lasso is not very helpful, maybe someday we can get a better error message. In any event I opened a ticket and have prepared a patch that needs review.
https://fedorahosted.org/ipsilon/ticket/162
For those of you who want to take a short cut and not redo your ipsilon-client-install it's easy to add the missing metadata element to /etc/httpd/saml2/metadata.xml, add this line, adjusted for your $HOST right below the existing AssertionConsumerService line:
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://$HOST/saml2/paosResponse" index="1"/>
Note, AssertionConsumerService are "indexed" endpoints, this is being added as index 1.