Allowing the Metadata to determine end-points

[Peter Schober]

* Antony den Dulk <antony at selestiasolutions.com> [2016-01-27 13:28]:
> I have received the following from another person using Shibboleth:
> "SAML 2.0 specifies different methods to assert an authentication request.
> Shibboleth out-of-the-box uses the method called 'non-specified' while our
> system uses the 'basic' method."

At last I have never heard anyone talk about auth requests in those terms.

> Seemingly the one of the differences between the 2 methods is that when
> sending an authentication request the 1st method (Shibboleth standard)
> sends the AssertionConsumerServiceURL while the basic does not. The effect
> of the 2nd method is that the Metadata is used to determine the
> AssertionConsumerServiceURL allowing the setup of various reverse-proxy
> scenaries.

The downside of not sending the endpoint being that (unless the authn
request is signed) the IDP has no chance to verify that the location it
should send the response to is legit and belongs to the SP in question
(as Issuer of the request). Such a check is not optional according to
the spec, IIRC.

> I have heard from another person that there is a way to arrange this in
> Shibboleth but they do not have details on how.

The question is why change the Shib SP from providing legal and useful
(if not signing: required) information?
If the IDP does not support valid auth requests it has a bug.
-peter