Dynamic (or Relative) URL for both IdP and SP

[Cantor, Scott]

> What I need to do, is to be able to control the url that is set as the action
> attribute to the html form when using POST binding. In other words, the url
> to which the saml authentication response is sent.

The SP aleady handles that automatically and if you try and interfere with that process, you will just break the login.

> I understand that this URL is read from SP's metadata (this would be in
> AssertionConsumerService element's Location attribute).

No, it's not. It's produced by the SP when it creates its request. It's *validated* against the metadata by the IdP, but that's not your problem here, you can include any number of endpoints in the metadata so the IdP will be fine with any one of them.

> So I need be able
> to tweak it depending on the host name of the IdP for each authentication request.

The ACS URL is derived from the *resource* being requested at the SP, because if you pick something else, it will simply loop and fail. If you want it to be different for different IdPs, then you need different resource URLs for which it will derive different ACS locations to use. You can forcibly control which ACS URL it uses, but ultimately that won't help you because it's just going to loop if the resource doesn't share a vhost with the ACS anyway.

-- Scott