ADFS SAML Assertion Consumer Endpoints wildcard

1
votes

I would like to know a solution to add a wildcard URL inside the SAML Assertion Consumer Endpoints. Something like that:

ADFS SAML ACS

For reviewing pull requests, each PR has its own environment with a generated URL. My goal is that each environment can use the same Relying Party Trust but I need to enter each domain for the SAML callback.

After some research, I found this article (https://dulanja.blogspot.fr/2014/07/dissecting-saml-spec-validation-of.html):

If the AssertionConsumerServiceUrl in does not match with any of the registered ACS URLs and if the request is signed (which removes the possibility of man-in-the-middle attack), then send the response to the ACS URL in the request only if the signature is valid.

I tried to sign my request from my SP but without success. I still have an error on the ADFS for an unregistered SAML ACS.

Can someone has a solution for this kind of problem?

Thanks!

1
wildcardsamladfs

1 Answers

0
votes

The whole point of specifying the ACS is for security.

In ADFS, you have a RP and that RP can only have one endpoint and that is the only endpoint ADFS can send to.

Wildcards just open up security holes.