使用 ADFS，SAMLResponse 不会发送到 SAMLRequest [authnRequest] 中出现的 ACS URL
我最初在使用 pingFederate 服务器时遇到了同样的问题，当时我在 idpInit SSO 端点中使用 acsIdx 属性作为查询字符串，我的问题得到了解决。
我想问 ADFS 中是否也有类似的属性，设置该属性后会将 saml 响应发送到所需的 ACS URL，而不是默认的。
另外，我想知道，如果我在 samlRequest 中设置assertionConsumerURL，即使 authnRequest 未签名，ADFS 是否也能够将响应发送到该 URL。
I had initially the same issue when using pingFederate server, that time I used acsIdx attribute as querystring in the idpInit SSO end point and my problem was solved.
I wanted to ask is there similar attribute in ADFS too, which when set will send the saml response to the desired ACS URL instead of the default.
Also, I wanted to know that if I set the assertionConsumerURL in the samlRequest will the ADFS be able to send the response to that URL, even if the authnRequest is not signed.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为 ADFS (RP-STS) 不可能在 AuthnRequest 中包含不同的 ACS URL 或 ACSIndex。在使用 ADFS 时，我从未见过这种类型的修改是可能的。
似乎可以让 ADFS（作为 IP-STS）根据 AuthnRequest 中的 ACS URL 或 ACS 索引向超过 1 个 ACS URL 发送断言，只要它们列在中继方信任端点列表中即可。但是，根据规范，如果未列出 ACS URL 并且 SP 未签署 AuthnRequest，则 ADFS 应拒绝 AuthnRequest，因为该 AuthnRequest 不合规。
HTH-伊恩
I don't believe it is possible to have ADFS (RP-STS) include a different ACS URL or ACSIndex in the AuthnRequest. In playing with ADFS, I've never seen that this type of modification was possible.
It seems possible to have ADFS (as the IP-STS) send an Assertion to more than 1 ACS URL based upon the ACS URL or ACS Index in the AuthnRequest as long as they are listed in the Relaying Party Trust Endpoints list. However, per the spec, if the ACS URL is NOT listed and the SP is NOT signing the AuthnRequest, then ADFS should reject the AuthnRequest as non-compliant.
HTH - Ian