AssertionConsumerURL Precedence

[Cantor, Scott]

On 10/22/20, 3:04 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of ndk at signet.id> wrote:

>    That URL, being arbitrary, isn't and can't be enumerated in their metadata.  My presumption is that the metadata is
> taking precedence over the signed request, being taken as more authoritative as having been vetted and signed by a third
> party rather than just the SP itself.

That's not how it works. If the signed request bypass is enabled, the IdP doesn't check it.

-- Scott