Same AssertionConsumerService for different SPs

[Cantor, Scott]

On 7/23/14, 9:38 AM, "Stefano Zanmarchi" <zanmarchi at gmail.com> wrote:

>on our IdP's metadata we have currently configured two SPs
>("https://hostA/shibboleth"
>and "https://hostB/shibboleth") which share a same
>AssertionConsumerService entry.
>It's working, I'm not now evaluating if this is the best solution and why
>it has been done,
>my concern is about formal correctness. I'm afraid that it's not and that
>sooner
>or later we could run into problems. Is this solution fine or should we
>avoid it?

I can't tell you about what other implementations do, but it's legal in
SAML and it works fine with Shibboleth (aside from the fact that with the
SP itself, you can't have a single installation of the SP handle one
endpoint without it mapping to one and only one applicationId and thus
entityID).

-- Scott