#685 BUG: SAML auth: SP-initiated flow not triggered (admin redirects to loginurl instead of generating SAMLRequest) Issue created by KshitijPatil98 When auth: "saml" is enabled for osctrl-admin, unauthenticated requests are redirected to the loginurl from saml.json. This works only for IdP-initiated SSO links. For IdPs that require SP-initiated SAML (expecting an AuthnRequest), the IdP returns an error (e.g., “Invalid Data / Data has not been captured”) because no SAMLRequest is ever sent by the SP. Current behavior • handlerAuthCheck (SAML branch) redirects 302 to samlConfig.LoginURL when no SAML session is present. • No AuthnRequest is generated; IdP receives a plain navigation to a login page and fails. Expected behavior • Support SP-initiated SAML: when there is no SAML session, the admin should initiate SAML and produce an AuthnRequest so IdPs that require SP-initiated flows succeed. • Continue to support IdP-initiated SSO for deployments that rely on a direct IdP app link (loginurl). How to reproduce 1. Configure admin.json with auth: "saml" and valid DB/Redis. 2. Provide saml.json with metadataurl, rooturl, loginurl, logouturl. 3. Use an IdP that expects SP-initiated SAML (generic SSO page, not an app link that posts to ACS). 4. Visit / on osctrl-admin → redirected to loginurl → IdP shows error (no SAMLRequest). Environment • osctrl-admin v0.4.4 / v0.4.5 (Docker images) • Auth method: SAML • HTTP behind reverse proxy/TLB; ACS at /saml/acs Impact • SAML cannot be used with IdPs requiring SP-initiated flows; only IdP-initiated app links work. • Blocks SSO integration for certain enterprise IdPs. Requested outcome • Add first-class support for SP-initiated SAML (generate and send SAMLRequest when no SAML session). • Preserve compatibility with existing loginurl IdP-initiated setups. jmpsec/osctrl