Question about AuthnRequest and ACS URL

[Yaowen Tu]

Hi,

I have a general question about AuthnRequest. In the request there is a
field called AssertionConsumerServiceURL. I am just wondering what is this
URL used for?

1. What is IdP supposed to do when it decrypt the request and find this
value? Should IdP compare the value with the one in the sp metadata file?
Or what?
2. On IdP side, should IdP redirect to the ACS URL in the AuthnRequest, or
the ACS URL in the metadata file of this SP?
3. If the ACS URL in the request is different from the one in the metadata
file, should IdP return error?

Or maybe this behavior is not defined in SAML? It depends on individual
IdP's implementation? So the best an SP to do is to send the same ACS URL
in the AuthnRequest as in the metadata file?


Thanks,
Yaowen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130312/ed400c9b/attachment.html