[JIRA] Commented: (SIDP-517) Wrong Treatment of ResponseLocation and Location in Metadata

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SIDP-517?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13651#comment-13651 ] 

Scott Cantor commented on SIDP-517:
-----------------------------------

ResponseLocation isn't used much, but the spec intends for it to override Location any time the message being sent is a Response as opposed to a Request. For an ACS, it's not generally used since the endpoint is only used for Responses, but it would take precedence as usual if it were used.

It's primarily meant for things like Logout, where both requests and responses might get sent to one endpoint element, and you needed to separate them for some reason in an implementation.

> Wrong Treatment of ResponseLocation and Location in Metadata
> ------------------------------------------------------------
>
>                 Key: SIDP-517
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-517
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>          Components: SAML 2
>    Affects Versions: 2.3.0
>         Environment: CentOS 5.6, Tomcat 6.0.29, Apache 2.2.3-45.el5
>            Reporter: maxhhh at idp.protectnetwork.org
>            Assignee: Chad La Joie
>            Priority: Minor
>             Fix For: 2.3.4
>
>
> If metadata of an SP for the SAML2 HTTP-POST ACS at the IdP contains both Location and ResponseLocation attribute, this makes the IdP select and check for the ACS URL of the ResponseLocation but redirect the message to the Location address.
> Scott said that "that would be a bug. The check has to be against the location actually used, and when you set a ResponseLocation, the Location should simply be ignored."

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira