Dynamic (or Relative) URL for both IdP and SP

[Kirill]

Scott,

Thank you for your answers. I am quite new to this so it takes me time to
understand your answers, but eventually they happen to be very helpful.
Really appreciate.

> It's produced by the SP when it creates its request.

Thanks to this piece of advice I realized that I can specify ACS URL in the
SP. I still have some issues trying to get everything to work, but at least
I am moving in the correct direction.

Thanks


On Fri, Feb 5, 2016 at 11:15 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > What I need to do, is to be able to control the url that is set as the
> action
> > attribute to the html form when using POST binding. In other words, the
> url
> > to which the saml authentication response is sent.
>
> The SP aleady handles that automatically and if you try and interfere with
> that process, you will just break the login.
>
> > I understand that this URL is read from SP's metadata (this would be in
> > AssertionConsumerService element's Location attribute).
>
> No, it's not. It's produced by the SP when it creates its request. It's
> *validated* against the metadata by the IdP, but that's not your problem
> here, you can include any number of endpoints in the metadata so the IdP
> will be fine with any one of them.
>
> > So I need be able
> > to tweak it depending on the host name of the IdP for each
> authentication request.
>
> The ACS URL is derived from the *resource* being requested at the SP,
> because if you pick something else, it will simply loop and fail. If you
> want it to be different for different IdPs, then you need different
> resource URLs for which it will derive different ACS locations to use. You
> can forcibly control which ACS URL it uses, but ultimately that won't help
> you because it's just going to loop if the resource doesn't share a vhost
> with the ACS anyway.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160216/422da11e/attachment-0001.html>