SAManage with Shibboleth 3?

[Tom Scavo]

On Fri, Apr 20, 2018 at 9:58 AM, Mark Cairney <Mark.Cairney at ed.ac.uk> wrote:
>
> On 20/04/18 14:23, Tom Scavo wrote:
>>
>> Earlier you posted an AuthnRequest that contained the following XML
>> attribute:
>>
>> AssertionConsumerServiceURL='https://desk.ei.ed.ac.uk/saml/edin'
>>
>> Where did that AuthnRequest come from? Usually an AuthnRequest is
>> issued by the SP, hence my ultimate question: How does your SP know to
>> add that XML attribute to the AuthnRequest?
>>
>> For the record, the ACS URL in the AuthnRequest must match the ACS URL
>> in metadata. So there's an apparent mismatch here. I'm trying to get
>> to the bottom of this.
>
> Ahh... that's a bit clearer. It's been a while since I "fixed" that issue.
> What happened when they gave it the "nice" FQDN was that the response came
> back from that URL and the IdP quite rightly barfed as it wasn't listed as
> the ACS URL for that SP in it's metadata. I worked around this by manually
> adding it to my local copy of their metadata.

We seem to be spinning our wheels, so I'll just state the
contradiction for the archives and let it go.

The claim is that the SP vendor does not know about the ACS endpoint
in the local copy of SP metadata at the IdP but yet the posted
AuthnRequest contains the endpoint location in question. If the SP
actually issued the posted AuthnRequest, then the SP *does* know about
the ACS endpoint. This is a contradiction.

Tom