When an SAML Authentication request is performed, let's say that the Service Provider uses an HTTP 302 redirect. The user agent is redirected to the IdP via a GET request. This URL is provided by the SP.
In this case, is the request:
- Of type XML, and
- is it signed, and/or
Because as per my current understanding SAML authentication becomes secure if it's encrypted and/or signed.
Additionally, if all these 3 things are true then does it matter that a URL could easily exceed 2048 characters?