Assertion Consumer Service URL vs Recipient

[kristof-mattei]

I'm working on integrating an SP with Ruby-SAML.

They POST a SAML assertion to me, and I validate it.

In terms of terminology they mandate the Assertion Consumer Service URL, which is where they will post the signed SAMLResponse to, AND a Recipient, which is put in the Subject as follows:

...
    <saml2:Subject>
      <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">john.doe@example.com</saml2:NameID>
      <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml2:SubjectConfirmationData NotOnOrAfter="2023-10-18T23:57:46.794Z" Recipient="https://example.com/some-value-i-put-in-there" />
      </saml2:SubjectConfirmation>
    </saml2:Subject>
...

However ruby-saml says that the Recipient in Subject/SubjectConfirmation/SubjectConfirmationData IS the assertion_consumer_service_url. I cannot separate them, which is confusing against the control panel I'm filling out.

Would this be a bug / missing feature in ruby-saml?

[pitbulk]

The toolkit assumes that ACS endpoint gonna be the Recipient.