How to set relayState

[Rob Whitener]

The approach we are going with is having a url scheme like
/partner/bigOrg/smallOrg, where /partner/bigOrg/ is the protected resource
 so that we can give BigOrg, the /partner/bigOrg/smallOrg urls for each of
their small orgs (for SP initiated SSO).  My hope was that the full URL
gets picked up by the SP and put into relayState and then the browser
redirects back to that full URL at the end of the flow.  What I have
noticed is the browser is redirected to /partner/bigOrg, which isn't really
what I wanted, but there is a cookie named _shibstate_**** that has the URL
I want in it.  What is shibstate and is it different from relayState?  I
don't actually see relayState anywhere in the server variables.

On Mon, Jul 16, 2012 at 1:58 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/16/12 1:53 PM, "Rob Whitener" <rob.whitener at audaxhealth.com> wrote:
> >
> >I am a little confused over the relayState parameter and specifically how
> >it gets set (or how I can get a value into relayState in my SP).  We are
> >working with a partner who, for reasons we still can't fathom, insist on
> >using relayState as a method of
> > partitioning out the organzations their customers belong to (rather than
> >just putting it into an attribute).  If I wan't a particular URL to be in
> >the relaystate, do I have to set up applicationOverrides to accomplish
> >that?
>
> The only thing the SP allows relay state to be is a token that it will use
> to identify the URL to send the browser after login. That's absolutely it.
> Assuming you want to control that URL, you simply protect that URL with a
> requireSession property and access it, or you generate a redirect to a
> SessionInitiator (/Shibboleth.sso/Login) and set target to the URL you
> want.
>
> Or you can manufacture an IdP-initiated SSO scenario at the IdP and that
> will document how RelayState can get set to a URL.
>
> But in all cases, all you're doing is controlling the URL to end up at.
> You cannot separate it from that function.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120716/c7a0fbbb/attachment.html