Strange behavior in shibboleth when receiving login request

[Cantor, Scott]

There is no way whatsoever that you can get a parameter added to the SP's initiator endpoint to make it all the way through all those layers if that's what you're mistakenly trying to do.

There are no "options" an SP will forward to an IdP that aren't inside the SAML request. The only other URL content comes from the SAML binding specification and nothing you do up front is going to alter that with the exception that if the metadata includes a SSO service endpoint that contains a query string, it will include that query string because that's statically defined information.

The forceAuthn parameter is parsed by the SP to embed ForceAuthn=true in the SAML request, that's all it does. It's not going to appear anywhere afterwards.

You have no role to play in messing about with the Spring WebFlow execution keys, those are system parameters managed by the control flow within the IdP and you have no control over what they are or how they change, that's automatic.

-- Scott