title: SAML flow handled incorrectly by Safari Browser working with ADFS?
body: <p>Here is the scenario - we have SSO enabled for our mobile clients and when they wish to use the SSO Auth process, we spawn a browser process to handle the SAML token generation process. It has been working well until recently where we encountered problems in a specific situation where customers use ADFS and try to sign on from IOS clients. IOS clients use Safari by default so the two players in this scenario are Safari (Apple) and ADFS (Microsoft) </p>
  
  <p>So the sequence starts by browsing to a URL (simplified to <a href="https://sso.mycomp.com/!saml2/scg3/sp-sso/post" rel="nofollow noreferrer">https://sso.mycomp.com/!saml2/scg3/sp-sso/post</a>) that is the first url to hit as a part of the SAML flow. The HTML content I receive from this end point is like the one shown below. (I have removed the SAML data for clarity)</p>
  
  <pre><code>&lt;html xmlns="http://www.w3.org/1999/xhtml"&gt;
    &lt;body onload="document.forms.samlform.submit()"&gt;
      &lt;noscript&gt;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; No JS, press the Continue to proceed.&lt;/p&gt;&lt;/noscript&gt;
      &lt;form id="samlform" action="https://intranet.mycomp.com/adfs/ls/" method="post"&gt;
      &lt;div&gt;
        &lt;input type="hidden" name="SAMLRequest" value”***SAML_REQUEST_DATA_WAS_HERE***”&gt;
        &lt;input type="hidden" name="RelayState" value="default"/&gt;
      &lt;/div&gt;
      &lt;noscript&gt;&lt;div&gt;&lt;input type="submit" value="Continue"/&gt;&lt;/div&gt;&lt;/noscript&gt;
      &lt;/form&gt;
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>It basically asks the browser to do a <strong><em>post</em></strong> operation to <a href="https://intranet.mycomp.com/adfs/ls/" rel="nofollow noreferrer">https://intranet.mycomp.com/adfs/ls/</a> after the HTML document is loaded by the browser. The body <strong><em>onLoad</em></strong> tag (line #2) and the form <strong><em>action/method</em></strong> tags (line#4) clearly define the operation to perform - i.e post to <a href="https://intranet.mycomp.com/adfs/ls/" rel="nofollow noreferrer">https://intranet.mycomp.com/adfs/ls/</a> - after the page is loaded.</p>
  
  <p>But the responses I get from Safari and Chrome browsers are different. On Chrome things work as expected but on Safari, the SSO sequence breaks. </p>
  
  <p>Here is the charles trace from Chrome.</p>
  
  <p><a href="https://i.stack.imgur.com/tUyvt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/tUyvt.png" alt="Opration performed on Chrome"></a></p>
  
  <p>Here is the trace from Safari. With the same response, it does a “get”</p>
  
  <p><a href="https://i.stack.imgur.com/sAfim.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sAfim.png" alt="Operation performed on Safari"></a></p>
  
  <p>Is there a way to overcome this issue or workarounds? Why is Safari not doing a POST and respecting the HTML that was passed to it?</p>
  
  <p>Any information would be helpful. </p>
  
  <p>Versions:
  Chrome - Version 51.0.2704.103 (64-bit)
  Safari - Version 9.1.1 (11601.6.17)
  ADFS - 2.0</p>