Behavior when skipEndpointValidationWhenSigned is used but ProtocolBinding isn't set

[Plovich, Tony]

Hello,

I'm seeing an issue with an SP that I'm trying to deploy using the skipEndpointValidationWhenSigned property.  The authentication request is failing with the error:

WARN [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:444] - Profile Action PopulateBindingAndEndpointContexts: Unable to resolve outbound message endpoint for relying party 'SP_ENTITY_ID_HERE': EndpointCriterion [type={urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService, Location=ACS_URL_HERE, trusted=true]

Checking the SP's AuthnRequest, I found that it's not setting the ProtocolBinding attribute.  Since we're relying on the signed AuthnRequest instead of the AssertionConsumerService metadata element, would the missing ProtocolBinding explain the failure we're seeing?

Thanks,

Tony Plovich
Business Information Services
Argonne National Laboratory
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240228/5d0bea35/attachment.htm>