single sign on - SAML 2 (Ping Federate) Should the AssertionConsumerServiceURL be accessible by the IdP? -
we building website using sso, on sp side , don't have control on idp. have multiple environment including local development servers.
the thing assertionconsumerserviceurl not accessible outside world (it 127.0.0.1/xyz) , told problem because idp needed make post request server.
however understood of "double post" method, user needs able access sp , there no direct communication between sp , idp (since user relay).
could please indicate if idp needs access sp "assertionconsumerserviceurl" directly ? if so, how should local development environment handled ?
the acs url need accessible user of sp browser based sso (for both redirect , post bindings). long have credentials idp (unlikely in many situations, unless control both sides), , can test end-to-end on own (e.g., company's "test harness"), need make acs url/sp application available user.
Comments
Post a Comment