SP Binding Problems

[Peter Schober]

* Michael Dahlberg <olgamirth at gmail.com> [2017-06-28 15:48]:
> When I question the SP, they state that thats because the IdP is issuing a
> GET request and that's whats causing the problem.  That seems wrong for
> several different reasons:
> 
> (1) There are no backchannel services open on my IdP, so I doubt the IdP is
> communicating directly with the SP.

Right, even then it would be the SP contacting the IDP directly.

> (2) I know I don't fully understand the binding protocols involved but it
> does not seem reasonable that an HTTP-POST, HTTP-POST-SimpleSign, or
> HTTP-Redirect would submit the SAML Response as a HTTP GET command

The SAML WebSSO Profile only allows HTTP-POST for delivery of the SAML
Response from the IDP (via the web browser) to the SP -- unless
Artifacts are at play, which they are not here from the authn request
you've shown.

Since you can rule out the IDP doing things behind your back all you
need to do is trace the HTTP traffic in your browser, then you see all
SAML requests and reponses being passed back and forth.
-peter