Q:

How does a SAML Service Provider match an IDP metadata information?

I'm using TestShib and Python Social Auth SAML backend to implement a Service Provider on a Django app.
I've been able to configure my app, and build a metadata file.
TestShib allows for my metadata file to be uploaded here.
I have configured TestShib's metadata correctly on my end and built up a test button pointing to TestShib's endpoint.
When I click that button, I get redirected to TestShib, then provide test credentials, and then I get an error because the metadata does not match the redirect.
How does TestShib, or any other IDP for that matter, manage to find the right metadata (among several SPs) after an incoming auth request? Does the EntityID have to match the URL of the Service Provider? 
EDIT: (added more info)
SP's metadata (uploaded previously to TestShib):
<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" cacheDuration="P10D" entityID="https://www.example.com">
    <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:KeyDescriptor xmlns:ds="http://www.w3.org/2000/09/xmldsig#" use="signing">
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>MIIDBDC .. QltX1icsr0=</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:KeyDescriptor xmlns:ds="http://www.w3.org/2000/09/xmldsig#" use="encryption">
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>MIIDBDC .. QltX1icsr0=</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://staging.example.com/complete/xx-saml/" index="1" />
    </md:SPSSODescriptor>
    <md:Organization>
        <md:OrganizationName xml:lang="en-US">example</md:OrganizationName>
        <md:OrganizationDisplayName xml:lang="en-US">Example</md:OrganizationDisplayName>
        <md:OrganizationURL xml:lang="en-US">https://www.example.com</md:OrganizationURL>
    </md:Organization>
    <md:ContactPerson contactType="technical">
        <md:GivenName>John Doe</md:GivenName>
        <md:EmailAddress>johndoe@example.com</md:EmailAddress>
    </md:ContactPerson>
    <md:ContactPerson contactType="support">
        <md:GivenName>John Doe</md:GivenName>
        <md:EmailAddress>johndoe@example.com</md:EmailAddress>
    </md:ContactPerson>
</md:EntityDescriptor>

Request:
https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO?SAMLRequest=fVNN  ...
<samlp:AuthnRequest
    AssertionConsumerServiceURL="https://staging.example.com/complete/saml/"
    Destination="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"
    ID="ONELOGIN_973a7f348c282cc6dedd4410f900efcf9538dcda" IssueInstant="2016-08-22T14:12:11Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" ProviderName="Example"
    Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer>https://www.example.com</saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="true"
        Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
    <samlp:RequestedAuthnContext Comparison="exact">
        <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
    </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

Error:
    10:10:39.009 - WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] - Relying party 'https://www.example.com' requested the response to be returned to endpoint with ACS URL 'https://staging.example.com/complete/saml/'  and binding 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' however no endpoint, with that URL and using a supported binding,  can be found in the relying party's metadata 
    10:10:39.009 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447]
    - No return endpoint available for relying party https://www.example.com

https://staging.example.com/complete/saml/ is available so the problem seems to be that the metadata info was not found by TestShib. Entity ID and Issuer seem to match .. 

A:

The Assertion Consumer Service URL in the AuthN Request (https://staging.example.com/complete/saml/) doesn't match the one in the metadata (https://staging.example.com/complete/xx-saml/), which is is also in line with the error thrown by the IdP. 
The quickest fix would be to edit the metadata and correct the <md:AssertionConsumerService.../> element so that it reflects the actual ACS to be used.

