<div dir="ltr">Just to confirm with above things Peter, I have copied the <IDPSSODescriptor> of two different IDP's below.<div> <div><b>IDP 1</b></div><div> <IDPSSODescriptor></div><div> <span style="color:black"> <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="</span><a href="https://shibboleth.musc.edu/shibboleth-idp/profile/SAML2/POST/SSO">https://shibboleth.musc.edu/shibboleth-idp/profile/SAML2/POST/SSO</a><span style="color:black">"/></span></div><div><font color="#000000"> </font> <SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
Location="<a href="https://shibboleth.musc.edu/shibboleth-idp/profile/Shibboleth/SSO">https://shibboleth.musc.edu/shibboleth-idp/profile/Shibboleth/SSO</a>"/></div><p class="gmail-MsoPlainText" style="margin-left:0.5in"><span></span></p>
<p class="gmail-MsoPlainText" style="margin-left:0.5in"> </IDPSSODescriptor></p><p class="gmail-MsoPlainText" style="margin-left:0.5in">* *we are missing redirect binding here </p>
<p class="gmail-MsoPlainText"><b>IDP 2</b></p><p class="gmail-MsoPlainText"><b> </b> <span style="font-family:Arial,sans-serif"> <IDPSSODescriptor></span><br></p>
<p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif">
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="<a href="https://cdc316-shibbolethidp.elsevier.com/idp3/profile/SAML2/POST/SSO">https://test.idp.com/idp3/profile/SAML2/POST/SSO</a>"/><span></span></span></p>
<p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif">
<SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="<a href="https://cdc316-shibbolethidp.elsevier.com/idp3/profile/SAML2/POST-%C2%A0%C2%A0%C2%A0%C2%A0%C2%A0%20SimpleSign/SSO">https://test.idp.com/idp3/profile/SAML2/POST-
SimpleSign/SSO</a>"/><span></span></span></p>
<p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif"> </span><span style="font-family:Arial,sans-serif;color:red"> <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="<a href="https://cdc316-shibbolethidp.elsevier.com/idp3/profile/SAML2/Redirect/SSO">https://test.idp.com/idp3/profile/SAML2/Redirect/SSO</a>"/></span><span style="font-family:Arial,sans-serif"><span></span></span></p>
<p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif">
<SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
Location="<a href="https://cdc316-shibbolethidp.elsevier.com/idp3/SSO">https://test.idp.com/idp3/SSO</a>"/><span></span></span></p>
<p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif"></IDPSSODescriptor><span></span></span></p><p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif">** we have redirect binding here.</span></p><p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif">These are the difference that tells SP, how to send messages to IDP. </span></p><p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif"><br></span></p><p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif">Thanks,</span></p><p class="gmail-msoplaintext" style="margin-left:0.5in"><span style="font-family:Arial,sans-serif">Satheesh </span></p></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 11, 2017 at 6:06 AM, Satheesh Kumar <span dir="ltr"><<a href="mailto:satheeshvsbk@gmail.com" target="_blank">satheeshvsbk@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks Peter, It is clear now :)</div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">On Mon, Sep 11, 2017 at 5:33 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Satheesh Kumar <<a href="mailto:satheeshvsbk@gmail.com" target="_blank">satheeshvsbk@gmail.com</a>> [2017-09-11 11:19]:<br>
<span>> We have SP 2.6 and when sending <authnrequest> to one of our<br>
> registered IDP, the attributes like "TARGET", "RelayState", "SAMLRequest",<br>
> "SAMLResponse", "SAMLart", "SigAlg" are encoded within a form as hidden<br>
> fields in "bindingTemplate.html" and the form is submitted along with authn<br>
> request. This is happening only for specific IDP's and I am not sure why<br>
> this is happening.<br>
<br>
</span>That's used when the SAML 2.0 Authentication Request (note the<br>
html/head/title of the bindingTemplate.html) needs to be sent to the<br>
IDP using the HTTP-POST protocol binding.<br>
<br>
Other IDPs may recieve authentication requests using the HTTP-Redirect<br>
protocol binding.<br>
<br>
You can find the details of those bindings in the SAML Bindings spec, e.g.:<br>
<a href="https://www.oasis-open.org/committees/download.php/56779/sstc-saml-bindings-errata-2.0-wd-06.pdf" rel="noreferrer" target="_blank">https://www.oasis-open.org/com<wbr>mittees/download.php/56779/sst<wbr>c-saml-bindings-errata-2.0-wd-<wbr>06.pdf</a><br>
<br>
As to *why* the SP uses HTTP-POST one time and HTTP-Redirect another:<br>
That depends on the bindings the IDP publishes in its SAML 2.0<br>
Metadata. The IDP recieving requests via HTTP-POST will likely only<br>
announce support for HTTP-POST in its SingleSignOnService element.<br>
<span class="m_-4972264637998246138HOEnZb"><font color="#888888"><br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div></div></div><span class="HOEnZb"><font color="#888888">-- <br><div class="m_-4972264637998246138gmail_signature" data-smartmail="gmail_signature">*Best wishes*,<br>*Satheesh K*<br><br><br><br></div>
</font></span></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">*Best wishes*,<br>*Satheesh K*<br><br><br><br></div>
</div>