title: Where is `InResponseTo` required in the SAMLResponse in an SP-initiated saml flow?
body: <p>Reading the <a href="https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf" rel="nofollow noreferrer">SAML core documentation</a> I can't figure out where <code>InResponseTo</code> is required (if anywhere) in an SP-initiated SAML2.0 Post Redirect flow.</p>
  <p>The docs stipulate that <code>InResponseTo</code> is optional in the <code>SubjectConfirmationData</code>. The documentation is quiet on whether or not <code>InResponseTo</code> should be part of the <code>Response</code> tag, although my experience is that in practice it's almost always present (I suspect the <code>InResponseTo</code>'s existence in the <code>Response</code> is covered by other SAML documentation that I haven't been able to find). Can the IdP decide freely if the <code>InResponseTo</code> value goes in the <code>Response</code> tag or in the <code>SubjectConfirmationData</code> (or even somewhere else)?</p>
  <p>(For the avoidance of doubt, I understand <code>InResponseTo</code> is not part of the <code>SAMLResponse</code> in an IdP-initiated response.)</p>