Commit 46a512a

@@ -4,7 +4,7 @@ class SessionsController < ApplicationController
 
   def new
     @uri = URI.parse(idp_metadata.single_sign_on_service_for(binding: :http_redirect)[:location])
-    redirect_to @uri.to_s + '?' + query_params
+    @redirect_uri = redirect_url_for(@uri)
   end
 
   def create
@@ -15,8 +15,9 @@ class SessionsController < ApplicationController
 
   private
 
-  def query_params
-    {
+  def redirect_url_for(uri)
+    uri.to_s + '?' +
+      {
       'SAMLRequest' => Saml::Kit::Request.authentication(assertion_consumer_service: session_url),
       'RelayState' => JSON.generate(inbound_path: '/'),
     }.map do |(x, y)|

@@ -1,8 +1,11 @@
 <div class="container">
   <div class="row">
     <div class="col">
-      <%= form_tag url: "" do %>
-        <% submit_tag "Log In to IDP" %>
+      <%= link_to "Log in to IDP via redirect", @redirect_uri %>
+      <%= form_tag @uri.to_s, method: :post do %>
+        <%= hidden_field_tag 'SAMLRequest', Saml::Kit::Request.authentication(assertion_consumer_service: session_url) %>
+        <%= hidden_field_tag 'RelayState', JSON.generate(inbound_path: '/') %>
+        <%= submit_tag "Log In to IDP via POST" %>
       <% end %>
     </div>
   </div>

@@ -1,4 +1,5 @@
 class SessionsController < ApplicationController
+  skip_before_action :verify_authenticity_token, only: [:new]
   before_action :validate_saml_request, only: [:new, :create]
 
   def new

@@ -1,6 +1,7 @@
 Rails.application.routes.draw do
   # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
   resource :session, only: [:new, :create, :destroy]
+  post "/session/new" => "sessions#new"
   resource :metadata, only: [:show]
   root to: "sessions#new"
 end