RemoteUserInternal

[Cantor, Scott]

You don't access that URL directly, it's handled within the sequence of redirects the IdP creates.

IdP initiated SSO does not start there, it works as documented.

Also, that's *not* RemoteUserInternal, that's RemoteUser. The RemoteUserInternal flow requires that all traffic into the IdP has already been authenticated so that REMOTE_USER is just "there", already. The RemoteUser flow uses the servlet, and redirects there during authentication so that only that URL has to be externally protected.

-- Scott