Looking at RFC2616, is it acceptable to return an HTTP 200 (page load) as a response to a SAMLResponse post to the SP? i.e. the user-agent loads a page instead of redirecting via a 302 / 303?
Looking for clarity on 3.4.5 here https://www.oasis-open.org/committees/download.php/35387/sstc-saml-bindings-errata-2.0-wd-05-diff.pdf - does the response to a SAMLResponse POST refer to point 2 or 5?
In other words:
- The browser sends a request to the IDP.
- The response is sent back to the browser - it is a form with an auto-submit to the SP, with a SAMLResponse field.
- My browser does a POST of the form to the inbound SAML endpoint at the SP
- The SP validates the assertion, authenticating the user, and then sends a 302 redirect back to the browser.
In step 4 above, are there any concerns or issues with the response being a "200" that loads a page? Is this step 5 of the above document, and effectively outside of the SAML flow at this point? Or is this step 2 or 4 that is still within the saml flow and should be maintained as a redirect?