SP computation of the ACS URL to include in <AuthnRequest>

[Michael A Grady]

> On Dec 18, 2016, at 3:06 PM, Scott Koranda <skoranda at gmail.com> wrote:
> 
> First, I would have expected the SP to construct the ACS URL
> based on the handler that was used to invoke the session
> creation.
> 
> Second, if the SP is computing the ACS URL I would have thought
> that the use of
> 
> UseCanonicalName On
> 
> would have forced it to use
> 
> https://site1.myserver.com
> 
> as the scheme:host combination. Nowhere in the Apache
> configuration is
> 
> alias1.site3.myserver.com
> 
> configured so I am surprised that the SP computes it.
> 
> With the observed behavior, the indication is that I would have
> to publish in metadata all possible alias and virtual host
> combinations since the ACS URL put into the <AuthnRequest> is
> being derived from the target.
> 
> Is that the case?
> 
> Or could I "pin" the ACS URL used by leveraging a SAML2 session
> initiator with an <AuthnRequest> template? Would the ACS URL in the template be
> respected by the SP when constructing the <AuthnRquest>?
> 
> Or am I missing something more fundamental?
> 
> Thanks,
> 
> Scott K

I'd never run into this before, but interestingly just 1.5 weeks ago I had this come up and had never realized that the SP had this behavior of taking the host from the target to construct the ACS endpoint. In my searching, the only mention of this behavior I could find was this mail thread from 2011:

   https://groups.google.com/forum/#!topic/shibboleth-users/6dFYMluBYNo

I can see why it would default to doing this, but was still surprised. I also briefly wondered if using a template would change that, but decided it seemed unlikely and didn't pursue trying it. Just got it to avoid having the target using different hostname, but the underlying web server setup wasn't nearly as complex as yours.

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20161218/0ced1086/attachment.sig>