funny AssertionConsumerService URL

[Cantor, Scott]

On 2/13/14, 11:50 AM, "Martin Haase" <Martin.Haase at DAASI.de> wrote:

>Hi,
>maybe I'm naive, but I always thought it is the ServerName directive
>that determines the SP's ACS URL when UseCanonicalName is On.

It is when you directly access a resource because the target in that case
is self-referential.

> By bugtracking this afternoon on some customer site, I learned that the
>target parameter dictates it as well. Might be sensible for other vhosts
>on the same box, but why does something like
>https://mysp.example.de/Shibboleth.sso/Login?target=http://www.google.de
>create, in the SAML Request, an ACS URL of
>http://www.google.de/Shibboleth.sso/SAML2/POST? Just asking...The IdP
>turns it down of course, but I had expected the real ACS URL in the
>request, and the SP redirecting to Google after AuthN.

Because otherwise you end up with a loop when the ACS and final resource
don't share cookies. Rationalizing based on target prevents hard to
diagnose errors by turning them into a simpler one (or in the case of a
typical situation, actually prevents the errors outright by issuing the
correct request).

There are also settings to limit off-host redirects, but I don't recall
when they come into play. They may prevent feeding in a target like that,
but I'm not certain.

-- Scott