Yes latest snapshot solves the problem.

I guess it is https://github.com/picketlink/picketlink-bindings/pull/93 which solved it right? And I guess it also solves the problem with session replication and other valves not being called

I have one more request/proposal: Is it possible to remove the code that serves the hosted page from the Valve? I mean, serving the hosted page should be handled the normal way eg a redirect from a /index.jsp and a directive from web.xml

This would simplify more the saml valve and have an idp war which could be able to host other functionality also (like password recovery, etc)

Thanks!