RemoteUserInternal

[Cantor, Scott]

> I will also look at the ECP flow again; from previous (e.g. long
> ago) experience that is more geared a programmatic solution
> geared toward SOAP.

It uses SOAP, it isn't about SOAP. It's about a client that's not a browser. If your client is not a browser, then ECP is the only supported flow outside of OAuth token requests.

If your client is a browser, then redirects are both expected and MTI, as is Javascript, forms, etc. All or nothing.

But the IdP does not add redirects for no reason. It requires them if you configure features that require views and not if you don't.

The end result is still browser-specific outside of ECP and a few other non-SAML cases, so I don't think it matters. A redirect is the least of your problems there.

-- Scott