I'm using the latest gosaml2 and noticed that my identity provider (Keycloak) does not accept the signed AuthNRequest.

The reason is:

• If a POST binding is used the signature is embedded in the XML.
• If a Redirect binding is used the signature is part of the URL query parameters.
  (e.g. https://idp/?SAMLRequest=...&RelayState=...&SigAlg=...&Signature=...)

But it seems that the Redirect binding authUrl does not have SigAlg and Signature parameters, even though setting SignAuthnRequests to true and SPKeyStore to my own Keystore.

reference: spring-projects/spring-security#7711