Does the SAML Identity Provider have to know which Service Provider the User is trying to authenticate with, during a Single Sign-On?
By looking at the specs, I see references to various elements that to me indicate an affirmative response to the previous question, namely:
protocol:AuthnRequest/Issuer
protocol:AuthnRequest/AssertionConsumerServiceURL
metadata:EntityDescriptor/AssertionConsumingService
And possibly others.
Background
The question might be naive to the expert, but I'm not an expert on the specific topic, and I'm trying to get an authoritative response because it concerns a fairly hot issue going on in Italy at the moment. It's being discussed, within the government, whether to enforce a SPID-based authentication scheme upon the many private social networks available in Italy, like Facebook, TikTok and the like.
SPID is a nationwide SAML-based authentication scheme citizens can use to identify themselves with internet-provided public services. Citizens are able to use SPID only after registering themselves with a state-approved Identity Provider using their own official identity documents (ID card, passport, and the like).
My concern is that enforcing the use of SPID with private social networks, not only anonymity will get thrown out of the window, but also that the state Identity Provider will be able to know which Services the User is accessing, thus profiling citizens, their habits and all that comes with it in terms of respect of (human) rights.