Shibboleth Developers

["Scott Cantor" <>]

> Could this be the Assertion Consumer Service location itself?  If the
> request has neither a SAMLResponse (Browser/POST) nor a SAML artifact,
> redirect to a default page.

That would be outside the spec. It's not needed, IMHO.

If you send an unsolicited response, it's good if the SP takes the
responsibility for directing the user to a default location, and the
software in fact supports this via homeURL. This is also yet another reason
I prefer to make each distinct service manage its own set of ACS endpoints
rather than multiplexing behind one set.

SAML 1.1 of course requires TARGET, but the software does go outside the
spec a bit and ignores a missing TARGET or accepts a value of "default" to
trigger that behavior.

-- Scott