（SalesForce SAML）SAML authNrequest是否有可能覆盖断言消费者服务网址（ACS）

Question

I'm trying to use the same salesforce app with multiple SAML service providers. All of the service providers have the same identifiers, the only things that I need from sales force is to send the SAMLResponses to Assertion Consumer Service(ACS) that I specify when I construct the authNresponse request.

When I construct the SP initiated an authentication request to SF I include the ACS URL(as AssertionConsumerServiceURL field) in the SAMLRequest token, but it doesn't seem to override the ACS URL that is mandatory in the connected apps SAML settings.

Maybe there is a way to override the ACS URL?

Answer 1

Not sure about SalesForce but in general, yes we can. Just add the AssertionConsumerServiceURL="xxx" tag to the AuthNRequest. I just tried this myself (with Optimal IdM). Unless SalesForce has restrictions in place that don't accept overriding, this is possible.

So a sample AuthNRequest would look like:

 <samlp:AuthnRequest Version="2.0" IssueInstant="2018-06-29T14:46:11.33Z" ForceAuthn="false" IsPassive="false" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="xxxxxxx"> <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">xxxxxxx</saml:Issuer> </samlp:AuthnRequest> 

PS: I know it's an old thread, but answering anyway for the sake of others.