Skip to main content

SAML SSO Sends an Incorrect ACS URL After Upgrade to 4001.0.0 When Enable IdP-Initiated SSO Is Not Selected

After upgrading to 4001.0.0, SAML SSO providers with Enable IdP-Initiated SSO disabled will generate an incorrect Assertion Consumer Service (ACS) URL. This can prevent users from completing SAML SSO authentication.

Description

After upgrading to version 4001.0.0, SAML providers with Enable IdP-Initiated SSO disabled will incorrectly use the registration alias when generating the ACS URL. This affects the SAML metadata and authentication request, resulting in a mismatch between the generated ACS URL and the URL configured in the SAML provider. When the Identity Provider receives the incorrect URL, SSO authentication will fail with an error indicating that the requested application cannot be identified.

Steps to Replicate

  1. Log into Blackboard Learn as an administrator

  2. Navigate to Administrator Panel > Authentication > Create Provider > SAML

  3. Enter a name for the SAML provider

  4. Set Authentication Provider Availability to Active

  5. Enter a value for Link Text

  6. Select Save and Configure

  7. Select Generate

  8. Open the generated SAML Metadata XML file

  9. Verify that Enable IdP-Initiated SSO is not selected for the SAML provider

  10. Compare the AssertionConsumerService URL in the generated metadata with the ACS URL configured for the SAML provider

Observed Behavior:
The ACS URL contains a registration alias even when Enable IdP-Initiated SSO is not selected.

Expected Behavior:
The ACS URL should not contain a registration alias when Enable IdP-Initiated SSO is not selected.

Affected Versions

  • Learn 4001.0.0

Target Release

SaaS Fixed (4001.0)

Did this answer your question?

Related Articles