Shibboleth sp Apache - Artifact profile or POST profile depending on idp

[Cantor, Scott]

It's basically not practical.

The only means of controlling it is really ugly and requires specifying an acsIndex setting that happens to match the index it generates for the Artifact ACS (or requires the old syntax of laying out the AssertionConsumerService handlers by hand and putting local index attributes on them).

Assuming the documentation isn't wrong, the problem is the only way to specify acsIndex at all is to also brute force the SessionInitiator elements the old way and stick it in the SAML2 one.

i.e. it's not part of the modern feature set to do it, it was a feature of the original handler syntax prior to the creation of the <SSO> shorthand and the protocols.xml file to automate all of it. Artifact was essentially a dead idea by then so it wasn't accomodated.

I don't know why it doesn't supoort using the acsIndex setting via the RelyingParty element, oversight I guess, or because that ACS selection code is already so bad that it wasn't a good idea to mess with it.

I worked on some of the comparative logic for this for V4 not that long ago, and indeed this whole area is very hard to deal with, it's why I took pains to make sure the new design could stick all the bindings at one endpoint and rectify that original choice.

-- Scott