RemoteUserInternal

[Cantor, Scott]

> I am still getting a 302 redirect when I use the Unsolicited
> SSO Flow.

The final result is going to be a form or a redirect depending on the response binding, the only way to stop that is the ECP flow, which is not that one.

There would not be expected to be any redirects in between without other features involved, interceptors mainly.

> My goal is treat the request like an ECP login.

The only guaranteed way to do that is with...ECP. That's what it's for. Anything else is aimed solely at browser clients and redirects are a part of that. The RemoteUserInternal flow is really only to support ECP-only deployments.

> What am I missing?

That probably would depend on what the redirect is actually from and to. We have ample evidence that redirects don't just happen because if it didn't, the ECP support wouldn't work.

> Much easier than having everything under /idp.

I don't know of any reason why that would matter apart from hosting multiple IdPs, which would be separate anyway. The IdP doesn't support any internal separation of that sort.  Policy is based on the identity of the SP, not on paths. Whatever you're doing there isn't supported.

-- Scott