Where to specify which ACS to use for logging in?

[Scott Koranda]

> >And if that really is too complex, what if I wanted to use not artifact, but
> http-redirect binding?
> Whoops, http-redirect binding isn't supported by shibboleth. Then I'll use
> another one:
> 
>   • urn:oasis:names:tc:SAML:2.0:bindings:PAOS
> 
> (just to see what changes are needed).

PAOS is not the binding you're looking for.

To use the artifact binding see the 'outgoingBindings' and
'acsIndex' attributes on the SAML2 SessionInitiator:

https://wiki.shibboleth.net/confluence/display/SHIB3/NativeSPSessionInitiator#NativeSPSessionInitiator-SAML2SessionInitiator(ProtocolHandler)

Use of the individual <SessionInitiator> elements instead of
<SSO> is an advanced configuration. You will want to use the
-t and -c flags when manually running /usr/sbin/shibd to test
your syntax.

You can also continue to use the <SSO> element but adjust the
order of the bindings in protocols.xml. See

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO

PAOS is used for ECP flows and not "normal" SSO flows.

Scott K