I have a Salesforce instance configured to act as an Identity Provider and am trying to connect a (non-Salesforce) Service Provider (client) to it. So we are making a SAML 2.0 samlp:AuthnRequest using the HTTP POST binding. Using the "Identity Provider Event Log" has been helpful for solving the initial problems.
But I am now stuck with this error:
Unable to resolve request into a Service Provider
and have not found any clear suggestions as to the cause by Googling.
("The "Service Provider" is the client and each "Service Provider" is represented by a "Connected App" in the Salesforce Identity Provider org.)
It would be helpful to understand how Salesforce handles the case of
samlp:AuthnRequest requests being made when there are multiple "Connected App" definitions. The only element in common between those two appears to the (
samlp:AuthnRequest) AssertionConsumerServiceURL and the (Connected App) ACS URL. I've tried tweaking these with no success (e.g. adding trailing slashes).
I note that the "IdP-Initiated Login URL" values include an app parameter that is different for each "Connected App".
Any explanation, insight, suggestions or solutions very welcome.