SP computation of the ACS URL to include in <AuthnRequest>

[Cantor, Scott]

> First, I would have expected the SP to construct the ACS URL
> based on the handler that was used to invoke the session
> creation.

I think it used to a really long time ago, but the result of that was people creating loops and wasting a lot of my time on the list asking about it over and over, so I changed it pretty far back to start computing the handlerURL for a target based on the target itself and not based on the current request's own URL.

To be honest, when I say "I changed it", I think that changed as far back as 2.0. If it was a change it came during 1.x or in the changes to get to 2.0. At least based on the history I see right now without real digging. Anyway, it's not recent at all is my point, this is just how it's worked for most of its life.

> Second, if the SP is computing the ACS URL I would have thought
> that the use of
> 
> UseCanonicalName On
> 
> would have forced it to use
> 
> https://site1.myserver.com

When you do name-based vhosting, you're actually trusting the client's choice of name but then forcing it to be handled by the vhost you choose. So the canonical name in that case is what the client sent. The difference is that if the client tries to fool it and choose a local name for the host, that's going to map to a different vhost (or in your case to the same one).

This is why in general it's just not safe to rely on the RequestMap on Apache. Too many holes depending on what you're doing.

> With the observed behavior, the indication is that I would have
> to publish in metadata all possible alias and virtual host
> combinations since the ACS URL put into the <AuthnRequest> is
> being derived from the target.
> 
> Is that the case?

If you don't sign your requests. These vhosting cases basically assume that you're signing requests (and that you get the IdPs to allow that bypass).

> Or could I "pin" the ACS URL used by leveraging a SAML2 session
> initiator with an <AuthnRequest> template? Would the ACS URL in the
> template be respected by the SP when constructing the <AuthnRquest>?

It is not respected with a template, there's no option for that at the moment.

I can see that for shared domain cases, it isn't necessarily the case that this behavior is desirable or useful, but that hasn't come up before.

-- Scott