Thoughts/best practice around SP to IDP token passing

[Cantor, Scott]

On 8/15/14, 11:26 AM, "Daniel Gay" <daniel.gay at quentinsystems.com> wrote:
>
>It's step 5 that I'm unclear as to the best way to do that.  The token
>(well really, I'd like the whole URL) gets lost in the redirects, but I
>was hoping that the original URL would be sent to the IDP and that I'd
>somehow have that info available to my custom code.
>
>Is this possible?  Any thoughts or direction greatly appreciated.

Anything is possible but access to the URL is prevented by design in the
SAML protocol other than by using RelayState and making assumptions that
only apply if you control both ends.

The formal way to do what you're after is with a SAML extension in the
AuthnRequest.

-- Scott