If you go to http://sp.example.com/protected you'll get properly redirected to the IdP for authentication. After authenticating the redirect to the SP will be redirected back to the IdP and then an infinite loop between the two.

This is due to the secure cookie. The browser doesn't send the cookie to an unsecure site so the SP thinks it needs to authenticate again, but it already is authenticated so back to the SP. Rinse and repeat.

The fix for this is to require SSL on the protected endpoint.

This issue ticket was originally removed from the tracker as it clashed with the pull request.
See upstream ticket for migration details.