clarification of unsolicited SSO behavior

[Tom Scavo]

Hi,

The documentation on unsolicited SSO [1] doesn't say how the IdP
chooses an endpoint location from SP metadata if one is missing in the
protocol message. Of the outbound bindings supported at the IdP, which
takes precedence? Also, if the SP supports multiple endpoints for a
given binding, which one does the IdP choose?

Thanks,

Tom

[1] https://wiki.shibboleth.net/confluence/x/UwBR