Unsolicited IDP: RelayState and target

[WULMS Alexander]

Hi,

Salesforce properly implements SAML v2 SP-initiated flow and also supports IdP-initiated flow.

Salesforce puts the relative URL to the requested page in the relaystate parameter. When you use the IdPUnsolicitedSSO handler on Shibboleth IdP, then you can indeed specify a value for the relaystate parameter. Though, keep in mind that you should URL-encode the relative URL when building your request string, especially if it contains special parameters or a query string.

Example to send a user to page /home/home2.jsp, on Salesforce my-domain your-organization.my.salesforc.com:

https://your-idp-host/idp/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2Fyour-organization.my.salesforce.com&target=%2Fhome%2Fhome2.jsp

This is under the assumption that you have set-up an own sub-domain, using their my-domain feature and that the entity-id for that sub-domain is https://your-organization.my.salesforce.com:

It works. At least for us (with Shibboleth IdP 2.3.5).

See Salesforce documentation and help pages for further details on their SAML support.

Thanks and brs,
Alex



> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-
> bounces at shibboleth.net] On Behalf Of Matt Woodson
> Sent: Monday, February 13, 2012 7:19 PM
> To: users at shibboleth.net
> Subject: Unsolicited IDP: RelayState and target
> 
> All,
> 
> I am trying to solve an issue we are having with Salesforce (SFDC) and
> our Shibboleth Unsolicited IDP instance.
> 
> When a user goes to a protected URL within SFDC while they are not
> authenticated, they get sent back to our IDP for authentication. After
> authenticating through our JBoss container, they are then sent back to
> SFDC, and the user will land at the home page inside of SFDC.  They
> will
> not be sent to the original protected URL.
> 
> When SFDC sends the user back to our IDP,  they also send back post
> data
> with a RelayState variable set to the originally requested protected
> URL.  I belive SFDC is trying to emulate an SP, but they aren't an
> official SP.
> 
> 
>  From what I can tell here,
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO,
> the target parameter can be passed in along with the entityID to
> emulate
> the RelayState.
> 
> Can I configured Unsolicited SSO to use the RelayState? Looking at the
> headers, it appears that the RelayState data is lost through
> authentication of my container.  If it can't be used, can the target
> parameter be configured to look at the RelayState post data?
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net