RemoteUserInternal

[Cantor, Scott]

> I will only have one exposed URI Context which would be the'
> IdP Initiated SSO, passing in the REMOTE_USER header (I can
> provide the details of how this protected if curious).

RemoteUser is almost always what you want, and that requires protecting the servlet URL and not the whole IdP, but if you really want every request to the IdP to be authenticated up front, you can do it that way.

The internal variants are basically for non-browser ECP support.

> I went back through the documentation; and I think I am
> missing something basic.

You're missing that you imported some piece of metadata from a vendor that has AuthnRequestsSigned set to true, which is incompatible with a flow involving no AuthnRequest to begin with. I added a sentence to the docs about it, I had thought it was already noted.

-- Scott