<div dir="ltr">I don't have control over the policies of the IdP. <div><br></div><div>I don't understand "each SSO role in metadata would not need a lot of endpoints".</div><div><br></div><div>Each one of my applications has the following endpoints:<div><div>    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="<a href="https://myapp1/Shibboleth.sso/SLO/SOAP">https://myapp1/Shibboleth.sso/SLO/SOAP</a>"/></div><div>    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="<a href="https://myapp1/Shibboleth.sso/SLO/Redirect">https://myapp1/Shibboleth.sso/SLO/Redirect</a>"/></div><div>    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://myapp1/Shibboleth.sso/SLO/POST">https://myapp1/Shibboleth.sso/SLO/POST</a>"/></div><div>    <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="<a href="https://myapp1/Shibboleth.sso/SLO/Artifact">https://myapp1/Shibboleth.sso/SLO/Artifact</a>"/></div></div><div><br></div><div>And that's just the SIngleLogoutService.  I also have 6 endpoints for the AssertionConsumerService.  50 apps (some of which are test) with 10 endpoints per app.</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 8, 2016 at 3:16 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">> That's self-contradicting. You say the SP has many entityIDs, so if that's true,<br>
> each SSO role in metadata would not need a lot of endpoints.<br>
<br>
</span>My underlying point is that validating endpoints isn't terribly efficient in the IdP if it's walking a list of 500 of them, though it wouldn't be noticeable until you get bigger I imagine. If you're going to do that, just sign your requests and skip the endpoint validation in the IdP.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>