SAML: How does AssertionConsumerService address get constructed - saml

Question

I am using the Spring SAML library.
When I generated SP's metadata, sometimes IP address of the server is used for AssertionConsumerService.
ex. I get something like this:
<md:AssertionConsumerService Binding="bindings:HTTP-POST" Location="http://12.34.56.78:8000/saml/SSO"/>
But sometimes the DNS address of the same server is used instead of 12.34.56.78.
My question is: How is AssertionConsumerService address generated?

Answer 1

Really, that AssertionConsumerService is just a URI, which is like this:
scheme:[//[user[:password]#]host[:port]][/path][?query][#fragment]
And DNS is just a alias to the IP, so as long as the endpoint can be used for SAML communication, IP or DNS both should work.
Another thing to note is since SAML communication needs secure channel, so https should be used instead of http for production.
Some XSD reference for this:
<element name="AssertionConsumerService" type="md:IndexedEndpointType"/>
<complexType name="IndexedEndpointType">
<complexContent>
<extension base="md:EndpointType">
<attribute name="index" type="unsignedShort" use="required"/>
<attribute name="isDefault" type="boolean" use="optional"/>
</extension>
</complexContent>
</complexType>
<complexType name="EndpointType">
<sequence>
<any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
</sequence>
<attribute name="Binding" type="anyURI" use="required"/>
<attribute name="Location" type="anyURI" use="required"/>
<attribute name="ResponseLocation" type="anyURI" use="optional"/>
<anyAttribute namespace="##other" processContents="lax"/>
</complexType>