Thoughts/best practice around SP to IDP token passing

[Daniel Gay]

Ok thanks Paul and Scott.  It seems like relay state might be a solution.

I changed the relay state setting on my SP and can now see the requested
URL passed as parameter to the IDP.  The IDP responds with a 302 though to
the AuthnEngine servlet, without the relay state parameter.  If I can make
an educated guess, the IDP must store the relay state somewhere for
eventual sending back to the SP.  From my custom login handler, where can I
get it?


On Fri, Aug 15, 2014 at 1:08 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 8/15/14, 11:26 AM, "Daniel Gay" <daniel.gay at quentinsystems.com> wrote:
> >
> >It's step 5 that I'm unclear as to the best way to do that.  The token
> >(well really, I'd like the whole URL) gets lost in the redirects, but I
> >was hoping that the original URL would be sent to the IDP and that I'd
> >somehow have that info available to my custom code.
> >
> >Is this possible?  Any thoughts or direction greatly appreciated.
>
> Anything is possible but access to the URL is prevented by design in the
> SAML protocol other than by using RelayState and making assumptions that
> only apply if you control both ends.
>
> The formal way to do what you're after is with a SAML extension in the
> AuthnRequest.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Daniel Gay
Quentin Systems LLC
571-249-4783
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140815/d7123083/attachment.html