<div dir="ltr"><div class="gmail_default" style="font-family:garamond,serif">Hi Scott and Nate,</div><div class="gmail_default" style="font-family:garamond,serif">Thanks for the prompt responses.</div><div class="gmail_default" style="font-family:garamond,serif">I agree that as per the standards the 'Destination' attribute should be provided, but, I am dealing with a IdP that is not very open to changes.</div><div class="gmail_default" style="font-family:garamond,serif">I will however, follow this up with them.</div><div class="gmail_default" style="font-family:garamond,serif"><br></div><div class="gmail_default" style="font-family:garamond,serif">Thanks again.</div><div class="gmail_default" style="font-family:garamond,serif"><br></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div><font face="garamond, serif">Thanks and Regards,</font></div><div><font face="garamond, serif"><br></font></div><div><p style="font-size:12.8px;background-image:initial;background-position:initial;background-repeat:initial"><b><span style="font-size:12pt">Amit Dongaonkar</span></b></p><p style="font-size:12.8px;background-image:initial;background-position:initial;background-repeat:initial"><i><span style="font-size:12pt">Snr. Technical Architect Lead</span></i><i><span style="font-size:12pt"></span></i></p><p style="font-size:12.8px;background-image:initial;background-position:initial;background-repeat:initial">o: <font color="#000000">(248) 284-4035</font> m: <font color="#000000">(248) 385-6033</font></p><p style="font-size:12.8px;background-image:initial;background-position:initial;background-repeat:initial">40850 Grand River Ave #100, Novi, MI 48375</p><p style="font-size:12.8px;background-image:initial;background-position:initial;background-repeat:initial"><span style="color:rgb(17,85,204)"><a href="http://www.nitssolutions.com/" style="color:rgb(17,85,204)" target="_blank">www.nitssolutions.com</a></span></p><p style="font-size:12.8px;background-image:initial;background-position:initial;background-repeat:initial"><img border="0" width="120" height="91" src="cid:image001.png@01D29DA4.739D6D20" alt="unnamed" style="width:1.25in;height:0.9479in"></p></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jun 29, 2020 at 7:01 PM Nate Klingenstein <<a href="mailto:ndk@signet.id">ndk@signet.id</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Right, sorry, I was looking at the recipient attribute of the EncryptedAssertion element rather than the decrypted assertion.  Is there a reason why that's the entityID rather than the ACS?<br>
<br>
e.g.<br>
<br>
<xenc:EncryptedKey Id="_bc87633cd07b3a990ce52517e20661fe" Recipient="<a href="https://samltest.id/saml/sp" rel="noreferrer" target="_blank">https://samltest.id/saml/sp</a>" ...<br>
<br>
Thanks for the catch,<br>
Nate.<br>
<br>
--------<br>
Signet, Inc.<br>
The Art of Access ®<br>
<br>
<a href="https://www.signet.id" rel="noreferrer" target="_blank">https://www.signet.id</a><br>
<br>
<br>
-----Original message-----<br>
> From: Cantor, Scott<br>
> Sent: Monday, June 29 2020, 4:45 pm<br>
> To: Shib Users<br>
> Subject: Re: Help Needed: Shibboleth SP handling of 'Recipient' SAML Attribute<br>
> <br>
> On 6/29/20, 6:38 PM, "users on behalf of Nate Klingenstein" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:ndk@signet.id" target="_blank">ndk@signet.id</a>> wrote:<br>
> <br>
> > Assuming you mean in a Response and Assertion, the destination and recipient attributes are intended to allow the SP<br>
> > to interpret how to process the response and to ensure it was made for it and not another SP.  The recipient should be<br>
> > the entityID and the destination should be the ACS URL.<br>
> <br>
> They are both set to the ACS URL in the profile.<br>
> <br>
> The only odd thing about the Shibboleth software is that it doesn't look at Destination unless the message is signed, since there's no point in doing so. It requires Destination when messages are signed because that's what the standard says.<br>
> <br>
> -- Scott<br>
> <br>
> <br>
> -- <br>
> For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
> <br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>