SAManage with Shibboleth 3?

[Cantor, Scott]

> The claim is that the SP vendor does not know about the ACS endpoint in the
> local copy of SP metadata at the IdP but yet the posted AuthnRequest
> contains the endpoint location in question. If the SP actually issued the
> posted AuthnRequest, then the SP *does* know about the ACS endpoint.
> This is a contradiction.

You seem to be supposing that the metadata the SP provides is connected in any meaningful way to how an SP is actually configured. That is generally a false assumption, which is why I repeat: I never rely on remote metadata provided by people that have no idea what they're doing (i.e. most vendors).

-- Scott