diff --git a/docs/simplesamlphp-upgrade-notes-2.0.md b/docs/simplesamlphp-upgrade-notes-2.0.md
index dc305801e97a6cdf7be6507669fa5a61891e80e7..c878fceae64514fcbaffc8eda61d51a345b0d14d 100644
--- a/docs/simplesamlphp-upgrade-notes-2.0.md
+++ b/docs/simplesamlphp-upgrade-notes-2.0.md
@@ -30,7 +30,7 @@ Functional changes
   It is possible to switch back via the `sharedkey_algorithm`.
   Note however that CBC is vulnerable to the Padding oracle attack.
 - All support for the Shibboleth 1.3 / SAML 1.1 protocol has been removed.
-- Unsolicited responses can denied by disabling it by setting `enable.saml20-unsolicited` to `false`.
+- Unsolicited responses can denied by disabling it by setting `disable_unsolicited` to `true` in the SP authsource.
 
 Configuration changes
 ---------------------
diff --git a/modules/saml/docs/sp.md b/modules/saml/docs/sp.md
index b6d174eec1568f3d31906383756d218f24580f56..1e3c864ff8b0de660a5319a3865f714c6f6e9bfe 100644
--- a/modules/saml/docs/sp.md
+++ b/modules/saml/docs/sp.md
@@ -219,6 +219,9 @@ Options
     in the IdP-remote metadata overrides this the option in the SP
     configuration.
 
+`disable_unsolicited`
+:    Whether this SP will refuse to process unsolicited responses. The default value is `false`.
+
 `discoURL`
 :   Set which IdP discovery service this SP should use.
     If this is unset, the IdP discovery service specified in the global option `idpdisco.url.saml20` in `config/config.php` will be used.
diff --git a/modules/saml/lib/Auth/Source/SP.php b/modules/saml/lib/Auth/Source/SP.php
index 508ad15b8b561369ac50519041061d56fb7467ea..a0b3829aed8232494a2296026097f7d049a3dbd6 100644
--- a/modules/saml/lib/Auth/Source/SP.php
+++ b/modules/saml/lib/Auth/Source/SP.php
@@ -1137,21 +1137,19 @@ class SP extends \SimpleSAML\Auth\Source
 
         $state['Attributes'] = $authProcState['Attributes'];
 
-        $config = Configuration::getInstance();
-        $allowUnsolicited = $config->getBoolean('enable.saml20-unsolicited', true);
-
-        Assert::true(
-            $allowUnsolicited,
-            'Unsolicited responsed are denied by configuration.',
-            Error\BadRequest::class,
-        );
-
         if (isset($state['saml:sp:isUnsolicited']) && (bool) $state['saml:sp:isUnsolicited']) {
+            $spMetadata = $source->getMetadata();
+            $disableUnsolicited = $spMetadata->getBoolean('disable_unsolicited', false);
+            if ($disableUnsolicited === true) {
+                throw new Error\BadRequest('Unsolicited responses are denied by configuration.');
+            }
+
             if (!empty($state['saml:sp:RelayState'])) {
                 $redirectTo = $state['saml:sp:RelayState'];
             } else {
                 $redirectTo = $source->getMetadata()->getString('RelayState', '/');
             }
+
             self::handleUnsolicitedAuth($sourceId, $state, $redirectTo);
         }
 
diff --git a/modules/saml/www/sp/saml2-acs.php b/modules/saml/www/sp/saml2-acs.php
index 097463cf98f54751c0875159a3f99ac05a274b54..7b943c988e2d8bfd2cde9e9be33cb5337f5bd608 100644
--- a/modules/saml/www/sp/saml2-acs.php
+++ b/modules/saml/www/sp/saml2-acs.php
@@ -94,23 +94,17 @@ if (!empty($stateId)) {
         $state = Auth\State::loadState($stateId, 'saml:sp:sso');
     } catch (Exception $e) {
         // something went wrong,
-        Logger::warning(
-            sprintf(
-                'Could not load state specified by InResponseTo: %s Processing response as unsolicited.',
-                $e->getMessage(),
-            ),
-        );
+        Logger::warning(sprintf(
+            'Could not load state specified by InResponseTo: %s Processing response as unsolicited.',
+            $e->getMessage(),
+        ));
     }
 }
 
-$config = Configuration::getInstance();
-$allowUnsolicited = $config->getBoolean('enable.saml20-unsolicited', true);
-
-Assert::true(
-    $allowUnsolicited,
-    'Unsolicited responses are denied by configuration.',
-    Error\BadRequest::class,
-);
+$disableUnsolicited = $spMetadata->getBoolean('disable_unsolicited', false);
+if ($state === null && $disableUnsolicited === true) {
+    throw new Error\BadRequest('Unsolicited responses are denied by configuration.');
+}
 
 if ($state) {
     // check that the authentication source is correct
@@ -165,6 +159,7 @@ $attributes = [];
 $foundAuthnStatement = false;
 
 // check for duplicate assertion (replay attack)
+$config = Configuration::getInstance();
 $storeType = $config->getString('store.type', 'phpsession');
 
 $store = StoreFactory::getInstance($storeType);