Sending AuthRequest without ACS

[Tom Scavo]

On Tue, Nov 1, 2016 at 2:10 PM, Rainer Hoerbe <rainer at hoerbe.at> wrote:
> When I send a request to a shib3 IDP without an AssertionConsumerServiceURL element from an SP supporting only one ACS endpoint, I would expect that the IDP would take the ACS URL from metadata. However, what I see in the log file is:
>
> 2016-11-01 17:59:38,804 - DEBUG [org.opensaml.saml.common.binding.AbstractEndpointResolver:220] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Returning 1 candidate endpoints of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService
> 2016-11-01 17:59:38,804 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:86] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate endpoint binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' not permitted by input criteria

The SP metadata is wrong. The ACS endpoint should be associated with
the HTTP-POST binding, not HTTP-Redirect. Sending a SAML response via
HTTP-Redirect is not feasible.

Tom