PicketLink does not include Destination URI for an AuthnFailed Response. This is an optional attribute but is required under PostBinding as per certain conditions.
From the spec "If the message is signed, the Destination XML attribute in the root SAML Spec element of the protocol message MUST contain the URL to which the sender has instructed the user agent to deliver the message . The recipient MUST then verify that the value matches the location at which the message has been received."
|