title: OpenAM as IDP does not redirect back to SP
body: <p>I got a problem with OpenAM. Need your help.</p>
  
  <p>I installed OpenAM and simply configured it as an IDP - set name and circle of trust. Then I added a remote SP by uploading <strong>SP metadata</strong>, see below</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;EntitiesDescriptor Name="urn:mace:shibboleth:testshib:two" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" mlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
  &lt;EntityDescriptor entityID="http://192.168.0.6:8080/employee/"&gt;
      &lt;SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol http://schemas.xmlsoap.org/ws/2003/07/secext"&gt;
          &lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
          &lt;/NameIDFormat&gt;
          &lt;NameIDFormat&gt;urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
          &lt;/NameIDFormat&gt;
          &lt;AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://192.168.0.6:8080/employee/" index="1" isDefault="true" /&gt;
      &lt;/SPSSODescriptor&gt;
  &lt;/EntityDescriptor&gt; 
  &lt;/EntitiesDescriptor&gt;
  </code></pre>
  
  <p>SP and IDP are in the same Circle of Trust.</p>
  
  <p>When I do SAML request for auth from SP to IDP, I get to login page of OpenAM with <em>SAMLRequest=...</em> as URL params. Decoded <strong>SAMLRequest</strong> is below</p>
  
  <pre><code>&lt;samlp:AuthnRequest AssertionConsumerServiceURL="http://192.168.0.6:8080/employee/"
  Destination="http://192.168.0.7:8181/openam/" ForceAuthn="false"
  ID="ID_479ff8a2-8dc5-44b5-997f-0438a2d87417" IsPassive="false"
  IssueInstant="2015-01-07T13:31:01.067Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
  Version="2.0"&gt;
      &lt;saml:Issuer&gt;http://192.168.0.6:8080/employee/&lt;/saml:Issuer&gt;
      &lt;samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" /&gt;
  &lt;/samlp:AuthnRequest&gt;
  </code></pre>
  
  <p>Then i do login and come to user profile page in OpenAM, instead of redirect to SP. Why it happens? What should I configure to enable redirect back to SP?</p>