Unsolicited IDP: RelayState and target

[Brent Putman]

On 2/17/12 2:14 PM, Matt Woodson wrote:
>
> Getting the replaystate into the Unsolicited url as the "target" 
> parameter is what I was originally asking help for.  That's the magic I 
> don't have.  And, according to replies, Unsolicited mode doesn't do 
> anything with that relaystate variable.
>

Well, a SAML IdP doesn't "do anything" with the RelayState, whether it's
a solicited SSO (SP-initiated) or unsolicited.  This is by definition
from the SAML standard.  The RelayState is a bit of data that the SP is
asking to be returned to it unmodified by the IdP when the user is sent
back to the SP.  So the IdP's job is to just faithfully reflect it back
to the SP exactly as it was received.  The only entity that actually
looks at that data and does something with it is the SP.

With unsolicited, you're just assuming (as the IdP admin) some knowledge
of what the SP would do with that data, and including an appropriate
value (or not, if none is needed)



>
> After more investigation and enabling domains at salesforce.com, we are 
> going to use sp-initiated SAML with shibboleth as the IDP.  Once this is 
> done, we can use the relaystate as it is meant to be.


So switching from unsolicited to solicited is not going to change what
the SP does or does not do with the RelayState data.  If you do
unsolicited (IdP initiated), and stick in RelayState value equal to what
the SP otherwise would have sent if you had done SP-initiated, the
result should be the same.