title: ADFS spring-saml No AssertionConsumerService is configured on the relying party
body: <p>saml with an ADFS idp. rutime error, the sp non-signed metadata was imported without problems in adfs idp but i'm facing a problem at run time:</p>
  
  <p>after idp authentication, on succesfull authentication, on the idp page i got a trust error like this:</p>
  
  <pre><code>The request specified an Assertion Consumer Service URL
  'https://test.it/au/login' that is not  configured on the relying party     'microsoft:identityserver:test.it'. 
  Assertion Consumer Service URL: https://test.it/au/login  Relying party:     microsoft:identityserver:test.it 
  that is a prefix match of the AssertionConsumerService URL     'https://test.it/au/login' specified by the request.
  This request failed.     
  </code></pre>
  
  <p>MY SP METADATA are like this:</p>
  
  <pre><code>&lt;md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"     ID="test.it" entityID="test.it"&gt;
  &lt;md:SPSSODescriptor AuthnRequestsSigned="false" 
  WantAssertionsSigned="false"     protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
  &lt;md:KeyDescriptor use="signing"&gt;
  &lt;md:AssertionConsumerService         Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
  Location="https://test.it:443/au/login" index="0" isDefault="true"/&gt;
  </code></pre>
  
  <p>I may add:
  if i start auth process from /adfs/ls/idpinitiatedsignon.htm
  and i choose my sp provider (so i excluded problems on the saml2p:AuthnRequest)
  a got a post redirect to <a href="https://test.it/au/lo" rel="nofollow noreferrer">https://test.it/au/lo</a>  gin"
  I wonder how is that my endpoint on idp has blanck spaces on it. </p>
  
  <p>I found this article that seems to explain
  <a href="http://social.technet.microsoft.com/wiki/contents/articles/4039.ad-fs-2-0-the-request-specified-an-assertion-consumer-service-url-that-is-not-configured-on-the-relying-party.aspx" rel="nofollow noreferrer">http://social.technet.microsoft.com/wiki/contents/articles/4039.ad-fs-2-0-the-request-specified-an-assertion-consumer-service-url-that-is-not-configured-on-the-relying-party.aspx</a>
  in short it says:</p>
  
  <p>There are two options:</p>
  
  <ol>
  <li><p>Configure the RP so that AssertionConsumerService is not specified in the AuthnRequest</p></li>
  <li><p>Configure the RP to send a AssertionConsumerService value in the AuthnRequest which matches 
  the AssertionConsumerService value on the Endpoints tab of the RP Trust in AD FS 2.0.</p></li>
  </ol>
  
  <p>what do you think</p>
  
  <p>if i generate metadata with   entityID="https://test.it:443/au/login"
  instead of entityID="test.it" could avoid this security issue ?</p>
  
  <p>or should i remove the AssertionConsumerService in saml:request (is it possible by configuration)?</p>
  
  <p>or should idp manager do better configuration?</p>