redirect after authentication by IdP

[Cantor, Scott]

On 1/17/14, 4:52 PM, "Qian, Yi" <yqian at ku.edu> wrote:
>
>My understanding is that the RelayState is defined on SP side, but we are
>IdP only

Then essentially you're not involved. It's the SP's job to orchestrate
this, not yours, unless the SP is not capable of issuing requests. In that
event, it's still not your job to embed URLs all over to make the right
thing happen. The RelayState, whatever it has to be, should be a fixed
token that is interpreted by them, such as an org or contract ID.
Otherwise you end up having to change links or configuration just because
a URL changes in some app. That's not an acceptable degree of coupling.

-- Scott