Issue with endpoint - "No return endpoint for relying party ...."

[Mark Watson]

Yep you're correct and I agree! I'll be fixing the instance where
HTTP-Redirect was used in the past.

On Thu, Jan 19, 2017 at 11:34 AM, Tom Scavo <trscavo at gmail.com> wrote:

> On Thu, Jan 19, 2017 at 2:13 PM, Mark Watson <mjw4tson at gmail.com> wrote:
> >
> > It seems like some identity providers are ok with accepting the
> > HTTP-Redirect as an AssertionConsumerService as I've gotten unsigned
> > assertions working using HTTP-Redirect on ADFS.
>
> Let me see if I understand. As the SP owner, you share metadata with
> AD FS that contains an AssertionConsumerService endpoint that supports
> the HTTP-Redirect binding but nothing more. Likewise your SP is
> configured to send an AuthnRequest to the IdP that identifies the
> HTTP-Redirect endpoint as your preferred return endpoint. Then AD FS
> does exactly that---it sends the Response to your HTTP-Redirect
> endpoint via HTTP redirect. Is that correct?
>
> If so, you're lucky that works. According to the SAML Web Browser
> Profile, HTTP-Redirect is specifically not allowed as an inbound
> binding at the SP. The AD FS IdP should not honor your request. Like
> TestShib, it should return an error.
>
> Tom
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170119/a94da1e3/attachment.html>