Is a query string parm allowed on SSO endpoint redirect URL?

[Cantor, Scott]

> I have an iDP that has this endpoint in their metadata:

The bindings are explicit about the parameters they permit, so really, no, that's not allowed. I imagine people do it, I don't know exactly what the SP does with it. In your example, you're running into something that's generally viewed as iffy anyway, using POST with a form action containing a query string.

> After authN comes back to my SP, I see this:

I don't understand what I'm looking at, that's not the SP, is it?

> So the question is, why does it drop that parm?  Is this not allowed for an
> endpoint?

I don't understand what is dropping what. Once it reaches the IdP, it's out of the SP's hands and the next SP access is to the AssertionConsumerService at the SP.

-- Scott