...
For the protection of the user, the valid AssertionConsumerService location(s) associated with a ServiceProvider must be registered in MetaData so that it can be checked by the IdentityProvider. This helps to prevent the delivery of personal information to unauthorized parties.
A typical AssertionConsumerService in ShibOnedotThreemight look like https://sp.example.org/Shibboleth.sso/SAML/POST
%COMMENT%