{"action":"created","issue":{"url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/355","repository_url":"https://api.github.com/repos/simplesamlphp/simplesamlphp","labels_url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/355/labels{/name}","comments_url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/355/comments","events_url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/355/events","html_url":"https://github.com/simplesamlphp/simplesamlphp/issues/355","id":144759273,"number":355,"title":"Using AssertionConsumerServiceURL in a signed AuthRequest","user":{"login":"stevenao","id":3785788,"avatar_url":"https://avatars.githubusercontent.com/u/3785788?v=3","gravatar_id":"","url":"https://api.github.com/users/stevenao","html_url":"https://github.com/stevenao","followers_url":"https://api.github.com/users/stevenao/followers","following_url":"https://api.github.com/users/stevenao/following{/other_user}","gists_url":"https://api.github.com/users/stevenao/gists{/gist_id}","starred_url":"https://api.github.com/users/stevenao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevenao/subscriptions","organizations_url":"https://api.github.com/users/stevenao/orgs","repos_url":"https://api.github.com/users/stevenao/repos","events_url":"https://api.github.com/users/stevenao/events{/privacy}","received_events_url":"https://api.github.com/users/stevenao/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/labels/needsinfo","name":"needsinfo","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-31T01:03:10Z","updated_at":"2016-03-31T08:16:27Z","closed_at":null,"body":"PingIdentity is allowing that. It is a sizable provider. I am assuming the SAML2 spec is allowing it. Currently, SimpleSamlPHP is not allowing it. All ACS's must match the ones in the registered sp metadata. \r\n\r\ncode: https://github.com/simplesamlphp/simplesamlphp/blob/b5648358afea9c52afb94b631cbdf4194ec18763/modules/saml/lib/IdP/SAML2.php#L150\r\n\r\nPingIdentity Doc: https://ping.force.com/Support/PingFederate/Administration/Specifying-Assertion-Consumer-Service-in-AuthnRequest\r\n"},"comment":{"url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/comments/203812785","html_url":"https://github.com/simplesamlphp/simplesamlphp/issues/355#issuecomment-203812785","issue_url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/355","id":203812785,"user":{"login":"jaimeperez","id":1942728,"avatar_url":"https://avatars.githubusercontent.com/u/1942728?v=3","gravatar_id":"","url":"https://api.github.com/users/jaimeperez","html_url":"https://github.com/jaimeperez","followers_url":"https://api.github.com/users/jaimeperez/followers","following_url":"https://api.github.com/users/jaimeperez/following{/other_user}","gists_url":"https://api.github.com/users/jaimeperez/gists{/gist_id}","starred_url":"https://api.github.com/users/jaimeperez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaimeperez/subscriptions","organizations_url":"https://api.github.com/users/jaimeperez/orgs","repos_url":"https://api.github.com/users/jaimeperez/repos","events_url":"https://api.github.com/users/jaimeperez/events{/privacy}","received_events_url":"https://api.github.com/users/jaimeperez/received_events","type":"User","site_admin":false},"created_at":"2016-03-31T08:16:27Z","updated_at":"2016-03-31T08:16:27Z","body":"Hi @stevenao!\r\n\r\nWhat is it exactly that SimpleSAMLphp does not allow? If you specify an `AssertionConsumerServiceURL` in the SAML `AuthnRequest`, SimpleSAMLphp will select that endpoint to send the response to it, provided that the URL matches with one endpoint registered in the metadata for the SP, of course.\r\n\r\nI don't understand if what you are proposing is to allow sending responses to endpoints that are **not** registered in the metadata. If that's the case, the SAML standard explicitly forbids this in the SAML 2.0 profiles document:\r\n\r\n>514  **4.1.4.1 \\<AuthnRequest\\> Usage**\r\n>...\r\n>532  Note that if the <AuthnRequest> is not authenticated and/or integrity protected, the information in it\r\n533  MUST NOT be trusted except as advisory. **Whether the request is signed or not, the identity provider**\r\n534  **MUST ensure that any `<AssertionConsumerServiceURL>` or**\r\n535  **`<AssertionConsumerServiceIndex>` elements in the request are verified as belonging to the service**\r\n536  **provider** to whom the response will be sent. Failure to do so can result in a man-in-the-middle attack.\r\n\r\nTherefore, SimpleSAMLphp will not allow such a behaviour, specially when such behaviour would have negative security implications. If PingIdentity is doing it, they are breaking the standard and putting their users at risk."}}