OpenSamlAuthenticationRequestFactory has a method called setProtocolBinding, which allows an application to indicate to IDPs the binding the IDP should use when sending the Response.
Both the SSO Service Location and Binding are in RelyingPartyRegistration.
But the ACS Location is in RelyingPartyRegistration and the ACS Binding is in OpenSamlAuthenticationRequestFactory, which creates some confusion.
For this ticket, OpenSamlAuthenticationRequestFactory#setProtocolBinding should be deprecated and a new method in RelyingPartyRegistration should be introduced that follows the SP metadata naming convention.