ProtocolBinding is not a mandatory field. Assume HTTP-POST if it's lacking.
ProtocolBinding is not a mandatory field. Assume HTTP-POST if it's lacking.

It is not right to disallow authnrequests without the protocolbinding,
since it's optional in the standard. EB only supports HTTP-POST, so that
seems a sane default. Further strengthened by saml2int's statement that
"The ProtocolBinding attribute, if present, MUST be set to
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST."

thijskh/OpenConext-engineblock,thijskh/OpenConext-engineblock,thijskh/OpenConext-engineblock,thijskh/OpenConext-engineblock