When creating metadata.xml file the md:AssertionConsumerService tag is added using "http(s)://{domain}/saml/consume" as the contents.
SAML supports multiple AssertionConsumerService tags so in theory we should be able to generate metadata which could contain the md:AssertionConsumerService tags for multiple domains. Then when the SAML Authentication request is generated it would explicitly define which ACS url to return the user to.
We would need a configuration field to allow for multiple domains to be listed, as well as if this is used require the Entity ID to be set as by default it will use "http(s)://{domain}/user" as the Entity ID and as the metadata would then be able to be requested from multiple domains we don't want there to be some confusion.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | 3098233-2-support-multiple-domains.patch | 26.58 KB | jrglasgow |
Comments
Comment #2
jrglasgow commentedthis patch should do the trick
It adds on the SP config form a text area to enter in different urls for the consumer service. It uses custom settings/metadata classes to generate the metadata using those urls, if no urls are entered in the default is used.
Comment #4
jrglasgow commented