Issue with endpoint - "No return endpoint for relying party ...."

[Tom Scavo]

On Thu, Jan 19, 2017 at 2:13 PM, Mark Watson <mjw4tson at gmail.com> wrote:
>
> It seems like some identity providers are ok with accepting the
> HTTP-Redirect as an AssertionConsumerService as I've gotten unsigned
> assertions working using HTTP-Redirect on ADFS.

Let me see if I understand. As the SP owner, you share metadata with
AD FS that contains an AssertionConsumerService endpoint that supports
the HTTP-Redirect binding but nothing more. Likewise your SP is
configured to send an AuthnRequest to the IdP that identifies the
HTTP-Redirect endpoint as your preferred return endpoint. Then AD FS
does exactly that---it sends the Response to your HTTP-Redirect
endpoint via HTTP redirect. Is that correct?

If so, you're lucky that works. According to the SAML Web Browser
Profile, HTTP-Redirect is specifically not allowed as an inbound
binding at the SP. The AD FS IdP should not honor your request. Like
TestShib, it should return an error.

Tom