Same AssertionConsumerService for different SPs

[Stefano Zanmarchi]

Hi all,
on our IdP's metadata we have currently configured two SPs ("
https://hostA/shibboleth"
and "https://hostB/shibboleth") which share a same AssertionConsumerService
entry.
It's working, I'm not now evaluating if this is the best solution and why
it has been done,
my concern is about formal correctness. I'm afraid that it's not and that
sooner
or later we could run into problems. Is this solution fine or should we
avoid it?
Thanks a lot,
Stefano


<md:EntityDescriptor ... entityID="https://hostA/shibboleth">
...
...
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://hostA/Shibboleth.sso/SAML2/POST"
index="0"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://hostC/Shibboleth.sso/SAML2/POST"
index="1"/>
...
</md:EntityDescriptor>

<md:EntityDescriptor ... entityID="https://hostB/shibboleth">
...
...
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://hostB/Shibboleth.sso/SAML2/POST"
index="0"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://hostC/Shibboleth.sso/SAML2/POST"
index="1"/>
...
</md:EntityDescriptor>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140723/d45ae900/attachment.html