SAML SSO动态ACS URL配置问题（SalesForce为IdP，我方为SP）

Hey there, I’ve run into this exact Salesforce SAML quirk before! Let me walk you through what’s going on and how to fix it.

First off, big shoutout to the AspNetSaml C# library—it’s a huge time-saver for handling SAML flows without having to roll everything from scratch.

The problem here is Salesforce’s default behavior: when you set up a Service Provider (SP) in Salesforce, it locks onto the fixed ACS URL you entered during setup, ignoring any dynamic ACS URL you pass in the SAML AuthnRequest XML. This isn’t an issue with AspNetSaml—it’s just how Salesforce’s SAML configuration works out of the box.

Here’s how to get Salesforce to respect your dynamic ACS URL:

• Log into your Salesforce admin panel, navigate to Setup > Identity > Single Sign-On Settings
• Find the SAML configuration entry for your SP, then click Edit
• Look for an option labeled something like "Allow ACS URL to be specified in the request" (the wording might vary slightly depending on your Salesforce edition) and check that box
• Save your changes, and you’re good to go!

Just to double-check, make sure you’re correctly setting the dynamic URL in your AspNetSaml code. Here’s a quick snippet to confirm:

var authnRequest = new SamlAuthnRequest();
// Assign your dynamic ACS URL here
authnRequest.AssertionConsumerServiceUrl = "_assertionConsumerServiceUrl";
// Rest of your SAML request setup...

After enabling that setting in Salesforce, it will honor the ACS URL you send in the request instead of sticking to the fixed one from the initial SP setup.

内容的提问来源于stack exchange，提问作者JustLooking