Sending AuthRequest without ACS

[Rainer Hoerbe]

Yes, I understand that this is not feasible when sending responses with attributes etc. But is it illegal from the spec?
(I am trying various configurations for the fedlab test harness).

- Rainer


> Am 01.11.2016 um 19:13 schrieb Tom Scavo <trscavo at gmail.com>:
> 
> On Tue, Nov 1, 2016 at 2:10 PM, Rainer Hoerbe <rainer at hoerbe.at> wrote:
>> When I send a request to a shib3 IDP without an AssertionConsumerServiceURL element from an SP supporting only one ACS endpoint, I would expect that the IDP would take the ACS URL from metadata. However, what I see in the log file is:
>> 
>> 2016-11-01 17:59:38,804 - DEBUG [org.opensaml.saml.common.binding.AbstractEndpointResolver:220] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Returning 1 candidate endpoints of type {urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService
>> 2016-11-01 17:59:38,804 - DEBUG [org.opensaml.saml.common.binding.impl.DefaultEndpointResolver:86] - Endpoint Resolver org.opensaml.saml.common.binding.impl.DefaultEndpointResolver: Candidate endpoint binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' not permitted by input criteria
> 
> The SP metadata is wrong. The ACS endpoint should be associated with
> the HTTP-POST binding, not HTTP-Redirect. Sending a SAML response via
> HTTP-Redirect is not feasible.
> 
> Tom
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net