Regarding SAML 2.0 IDP initiated flow, as per the different documentation and tutorials, I feel the SAML response should be redirected from browser to service provider.