Sending AuthRequest without ACS

[Rainer Hoerbe]

When I send a request to a shib3 IDP without an AssertionConsumerServiceURL element from an SP supporting only one ACS endpoint, I would expect that the IDP would take the ACS URL from metadata. However, what I see in the log file is:

2016-11-01 17:59:38,804 - DEBUG [org.opensaml.saml.common.binding.AbstractEndpointResolver:220] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Returning 1 candidate endpoints of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService  
2016-11-01 17:59:38,804 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:86] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate endpoint binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' not permitted by input criteria  


This was the request:

<ns0:AuthnRequest  
    Destination="https://testidp01.samltest.fed-lab.org/idp/profile/SAML2/Redirect/SSO"
    ID="id-v60zklS6xbrDC2Pzm" IssueInstant="2016-11-01T17:59:36Z"  
    Version="2.0" xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion">
    <ns1:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://localhost:8087/acs-redirect/sp.xml</ns1:Issuer>  
</ns0:AuthnRequest>


- Rainer