title: Sustainsys.SAML2 uses http-redirect instead of http-post
body: <p>I should say that I've just started exploring SAML authentication and bumped into authentication problem which unfortunately I cannot reproduce on my development machine which confuses me even more.</p>
  
  <p>I have the following configuration using OWIN:</p>
  
  <pre><code>var options = new Saml2AuthenticationOptions(false)
  {
      Notifications = new Saml2Notifications
      {
          AuthenticationRequestCreated = (request, provider, dictionary) =&gt;
          {
              request.Binding = Saml2BindingType.HttpPost;
          }
      },
      AuthenticationType = services.AuthenticationType,
      Caption = services.Caption,
      SPOptions = new SPOptions
      {
          EntityId = new EntityId(Path.Combine(services.RelyingPartyUri, "Saml2"))
      }
  };
  
  options.IdentityProviders.Add(new IdentityProvider(new EntityId(services.IdentityProviderConfiguration.IdentityProviderMetadataUri), options.SPOptions)
  {
      AllowUnsolicitedAuthnResponse = true,
      Binding = Saml2BindingType.HttpPost,
      LoadMetadata = true,
      SingleSignOnServiceUrl = new Uri(services.IdentityProviderConfiguration.SingleSignOnUri)
  });
  
  app.UseSaml2Authentication(options);
  </code></pre>
  
  <p><code>services</code> variable contains configuration such as metadata uri, sso uri, etc.</p>
  
  <p>This configuration works perfectly on my machine. I've inspected login SAML request and here is what I have there:</p>
  
  <pre><code>&lt;saml2p:AuthnRequest 
      xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 
      xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" 
      ID="id10c4b76119b64952857d38c7581ca0b4" 
      Version="2.0" 
      IssueInstant="2018-12-04T14:29:00Z" 
      Destination="https://identity.provider/trust/saml2/http-post/sso/application" 
      ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
      AssertionConsumerServiceURL="https://application/Saml2/Acs"&gt;
      &lt;saml2:Issuer&gt;https://application/Saml2&lt;/saml2:Issuer&gt;
  &lt;/saml2p:AuthnRequest&gt;
  </code></pre>
  
  <p>The authentication then works fine.</p>
  
  <p>When I deploy this code to external server for testing purpose some times it works as expected but quite often I cannot authenticate user because instead of http-post the authentication mechanism uses http-redirect.</p>
  
  <p>In this case I see the following login SAML request:</p>
  
  <pre><code>&lt;saml2p:AuthnRequest 
      xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" 
      xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" 
      ID="id10c4b76119b64952857d38c7581ca0b4" 
      Version="2.0" 
      IssueInstant="2018-12-04T14:29:00Z" 
      Destination="https://identity.provider/trust/saml2/http-redirect/sso/application" 
      ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
      AssertionConsumerServiceURL="https://application/Saml2/Acs"&gt;
      &lt;saml2:Issuer&gt;https://application/Saml2&lt;/saml2:Issuer&gt;
  &lt;/saml2p:AuthnRequest&gt;
  </code></pre>
  
  <p>The difference in the SSO uri which is used for authentication.</p>
  
  <p>What I did so far is checked configuration files to eliminate configuration issue. All configurations are valid and <code>services.IdentityProviderConfiguration.SingleSignOnUri</code> contains valid SSO uri with http-post. I've played around with different settings and as you may see in the code snippet I set Binding to HttpPost which I thought should have solved my issue in case if <code>SingleSignOnServiceUrl</code> is taken automatically from IDP metadata. I also looked through sustainsys.SAML2 source code and couldn't find anything which could give me a clue.</p>
  
  <p>Any help highly appreciated!</p>