Multiple ACS urls

In our experience, service providers (SP) generally use one ACS URL as opposed to multiple ACS URLs in their saml metadata. We should also note that for intents and purposes in this article when we refer to saml we are referring to SAML 2.0. This article will also shorten the term Assertion Consumer Service URL for ACS URL.

Even more specifically, this article is written for administrators of the Apereo CAS product that use raw xml files for metadata as opposed to a UI.

The ACS URL is an endpoint that the SP provides for the IDP (Identity Provider, in this case CAS) to redirect with the authentication response. For obvious reasons, this endpoint should be protected by HTTPS. To this endpoint the IDP will send a NameID and other assertions about the principal including attributes such as group membership, name, department, classes, email address, etc.

If you have been tasked with manually constructing an SPs metadata, a great tool to use for this is created by onelogin and located here.

https://www.samltool.com/sp_metadata.php

If you notice, the tool only allows for one ACS URL. So the question becomes, are multiple ACS URLs even supported? My SP says so, yet the most recent version (as of November 15, 2023) of the most popular saml builder tool does not support it.

The answer is that yes, SAML 2.0 does support multiple ACS URLs. For example, this SP metadata example contains multiple ACS URLs, differentiated by an index.

An optional flag to use is isDefault=”true”.

<?xml version="1.0"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
        entityID="https://example.com/example/">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                Location="https://example.com/example/1"
                        index="1" isDefault="true" />
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                Location="https://example.com/example/2"
                        index="2" />
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                Location="https://example.com/example/3"
                        index="3" />
    </md:SPSSODescriptor>
</md:EntityDescriptor>

Conclusion – Multiple ACS URLs

This article has demonstrated how to configure more than one ACS URL in your saml metadata. Let us know in the comments if you have any questions or would like to learn more about saml assertion consumer service URLs. See more of our articles on saml and CAS.