It is not OK to tell what the current SAML request binding type is by simply look at the current request method in IDPWebRequestUtil.java.

For example, the SP using post binding, when the SAML request comes to idP, AbstractIDPValve will store the SAMLRequest message in session, and show the log in page.

But what if the user refresh the log in page, this time the request method turns to be "Get", but the SAMLRequest message in session is still in post format.

When user enter their password and user name and trying to log in the system.

IDPWebRequestUtil this time will get the wrong binding type.

The idea is, binding type type should be always compatible with the SAMLRequest message format, that say, store binding type in session togather with the SAMLRequest message.