IdP change relaystate depending on attributes

[Cantor, Scott]

On 10/27/11 10:52 AM, "Joseph Valerio" <joseph.valerio at yale.edu> wrote:
>    I got a request today for our IdP to change the relaystate for a SP
>    depending on attributes of the user.

The standard does not allow you to do this. It's their job to set it
appropriately or dispatch afterward.

An alternative is to use IdP initiated SSO. The only RelayState in that
case is what the IdP decides to generate. That's probably what I would do
in the face of an SP refusing to support the standard.

-- Scott