SP ACS extra query string parameter rejected by IdPv3, not rejected by IdPv2

[Cantor, Scott]

> > Not exactly sure, but it looks like the V2 AuthnResponseEndpointSelector
> checks the ACSURL index then the location, while the V3
> DefaultEndpointResolver checks the location then the index.
> 
> Well, I believe the above is incorrect. V2 only checks the index, while V3
> checks both the index and the location. So, V2 will ignore an incorrect
> location if the index matches.

A request containing both would definitely be "weird", but if your supposition is that these cases are such that the index was provided, and that was why V2 had been working, I could buy that. I'm pretty certain its location checking was just as simple as now, string comparison.

That particular case would be underspecified but if somebody wants to file that as a regression, I wouldn't fight it.

-- Scott