Decoding the relaystate URL parameter

[Cantor, Scott]

On 2/13/14, 11:40 AM, "Sean Bergam" <sbergam at truenorthlogic.com> wrote:
>I assume this somehow contains/points to the original URL the user
>requested because I can¹t find that anywhere else in the message.  Can
>someone please confirm/deny?  Thank you!

The SP does use it to track the original URL, yes. That is however an
implementation detail, it's up to the implementation what it decides to
track and how.

The SP supports 3 different relay state strategies, configured with the
relayState setting. Quoting the documentation:

"Controls how information associated with requests for authentication,
primarily the original resource accessed, is preserved for the completion
of the authentication process. If not specified, the resource
 URL is passed by value to the IdP, when possible. A value of "cookie"
causes the URL to be saved in a cookie, to protect the user's privacy. A
third option, which is recommended, is to use the SP's persistent storage
by specifying a value of the form "ss:id", where id references a
<StorageService> element, typically "ss:mem". As of V2.5, the "cookie"
option can include a ":n" suffix, where n specifies the number of cookies
to permit before purging old ones, defaulting to 25."


-- Scott