SP: sending HTML form template to client

[Peter Schober]

* Satheesh Kumar <satheeshvsbk at gmail.com> [2017-09-11 11:19]:
>      We have SP 2.6 and when sending <authnrequest> to one of our
> registered IDP, the attributes like "TARGET", "RelayState", "SAMLRequest",
> "SAMLResponse", "SAMLart", "SigAlg"  are encoded within a form as hidden
> fields in "bindingTemplate.html" and the form is submitted along with authn
> request. This is happening only for specific IDP's and I am not sure why
> this is happening.

That's used when the SAML 2.0 Authentication Request (note the
html/head/title of the bindingTemplate.html) needs to be sent to the
IDP using the HTTP-POST protocol binding.

Other IDPs may recieve authentication requests using the HTTP-Redirect
protocol binding.

You can find the details of those bindings in the SAML Bindings spec, e.g.:
https://www.oasis-open.org/committees/download.php/56779/sstc-saml-bindings-errata-2.0-wd-06.pdf

As to *why* the SP uses HTTP-POST one time and HTTP-Redirect another:
That depends on the bindings the IDP publishes in its SAML 2.0
Metadata.  The IDP recieving requests via HTTP-POST will likely only
announce support for HTTP-POST in its SingleSignOnService element.

-peter