https://usertest.sciquest.com and specifying acsIndex

[Wessel, Keith]

Nope, the SP I was having trouble with was Web of Science from Thompson Reuters, and it was a completely different issue: SP requesting response endpoint by index rather than URL, and the ACS index they were requesting doesn't exist in their InCommon metadata.

David, you would have to examine the authn request to confirm, but it sounds like they might not be requesting any ACS endpoint and thus the IdP is falling through to the default. None are marked as default in the InCommon metadata. So, and Scott can confirm, I think the IdP picks the first one if the SP doesn't specify one and none are marked in metadata as default.

It's also, of course, possible that the authn request always contains that particular response endpoint and, as Scott said, that element of the request must be honored by the IdP.

Either way, you should reach out to their technical contact in metadata or, if you have an existing communication channel with someone from the vendor, with them. Just let them know that requests to your IdP don't seem to contain the ACS endpoint for Indiana. There may be some magic URL you need to go to on their side to get their SAML implementation to include the right ACS endpoint in the authn request. If so, that's a rather odd implementation, but I think I can safely say that most of us have seen equally sketchy things in home-grown SAML implementations.

If you don't hear back, InCommon operations might be able to try as well to help (with apologies to Nick and crew for giving them more work).

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Monday, August 26, 2019 2:56 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: https://usertest.sciquest.com and specifying acsIndex

Keith Wessel reported it and got InCommon to reach out to their contacts I believe.

>  Does anyone know of a way to designate to the IDP the acsIndex to be used per Service?

The SP's request is required to be honored.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net