Help with relay state

[Johnson, Jacob (GE, Intelligent Platforms)]

Thank you for the quick response, Scott.

I observe the same behavior using ss:mem.  The reason I switched it to
cookie was because I'm not sure if it will work with my IdP, which is not
Shibboleth and not under my control.

When I switched it back to ss:mem, this is what I see in the shibd log:

2013-08-12 16:10:17 DEBUG XMLTooling.StorageService [2]: inserted record
(cbeb1568b6db00f5057ce1e7821f21bfd5caa6a7160e5c9c55f0ab764e7a6524) in
context (RelayState) with expiration (1376325599)

I take this to mean, SP is storing the original resource in RelayState.
It then redirects to my IdP and appends a URL parameter that looks like
this:

&RelayState=ss%3Amem%3Acbeb1568b6db00f5057ce1e7821f21bfd5caa6a7160e5c9c55f0
ab764e7a6524


At this point, I'm assuming my IdP is responsible to remember this
parameter and feed it back to the SP.  However, I don't control my
company's IdP and don't think they will send this info back without some
change.  Please let me know if I'm wrong here, but I'm assuming I can't
use ss:mem in my environment for this reason.

When I switch to using cookies, I no longer see the StorageService message
related to inserting the RelayState record.  Instead, the SP sets a cookie:

Set-Cookie: 
_shibstate_1376325820_1690=http%3A%2F%2Fip-10-15-141-173.com.cloud.ge.com%2
Fdwportal%2Findex.jsp; path=/; HttpOnly;

So, the SP creates the relay state cookie and then in the subsequent SAML
assertion, I see my the relay state cookie fed back like this:

Cookie: 
_shibstate_1376325820_1690=http%3A%2F%2Fip-10-15-141-173.com.cloud.ge.com%2
Fdwportal%2Findex.jsp;


So, that seems correct to me too.  However, the SP redirects me to "/"
instead of "/dwportal/index.jsp".  Is there any additional logging I can
turn on to troubleshoot further?

Jake










On 8/12/13 10:27 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>> The cookie contains the URL that I want to redirect to, but the app
>>does not
>> redirect as expected.
>
>Then the IdP is mangling the RelayState, or the cookie isn't being
>returned. There's also no reason to use a cookie anymore unless you're
>clustering, use the default (ss:mem).
>
>-- Scott
>
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net