fix: default assertion_consumer_service_url not set during callback

Fix a bug where ruby-saml would fail SubjectConfirmation Recipient
validation when using the default assertion_consumer_service_url. The
url was not being set during the callback phase.

This closes omniauth#139

lib/omniauth/strategies/saml.rb

@@ -32,8 +32,6 @@ def self.inherited(subclass)
  option :idp_slo_session_destroy, proc { |_env, session| session.clear }
 
  def request_phase
- options[:assertion_consumer_service_url] ||= callback_url
-
  authn_request = OneLogin::RubySaml::Authrequest.new
 
  with_settings do |settings|
@@ -212,6 +210,7 @@ def generate_logout_request(settings)
  end
 
  def with_settings
+ options[:assertion_consumer_service_url] ||= callback_url
  yield OneLogin::RubySaml::Settings.new(options)
  end
 

spec/omniauth/strategies/saml_spec.rb

@@ -157,6 +157,16 @@ def post_xml(xml=:example_response, opts = {})
  end
  end
 
+ context "when the assertion_consumer_service_url is the default" do
+ before :each do
+ saml_options.delete(:assertion_consumer_service_url)
+ OmniAuth.config.full_host = 'http://localhost:9080'
+ post_xml
+ end
+
+ it { is_expected.not_to fail_with(:invalid_ticket) }
+ end
+
  context "when there is no SAMLResponse parameter" do
  before :each do
  post '/auth/saml/callback'