What if more than one RelayState's send to the IDP?

Surinaidu Majji pioneer.suri at gmail.com
Thu Feb 19 00:36:57 EST 2015


I have an application connecting with IDP. I am using 'externalAuth' Login
handler to authenticate. Here my application is communicating
two times with Shibboleth Idp.

1) When the user try to access to one of our application(SP), We just
prepare a Saml request,Relaystate and send it to the IDP, then
it will execute the externalAuth handler and display the login page to the
user.

2) Again we are redirecting to the idp, once the credentials are enterd by
user in login page validated against our database, then the
idp is giving saml response and relay state which we have sent in the above
step.

Based on the Relay state(key for map), i am maintaing a map to store some
values before smal request is sending to the idp. in this case
i am facing one problem which is described below.

-> I am communicating 2 times with an idp to give an access to our
application to the user. one is before showing login page and another one is
after login page.As per my observation the idp sends the 'RelayState' which
my SP was sent earlier.
-> I am getting the 'Relaystate' as a response after second communication
with an idp.

Here my question is:
Q1) What if i opened two tabs(same browser) with login page.We are sending
two "Relaystate" to display login page in two tabs, but
    if user enters the credentials in the first tab and redirects to the
idp, it will give 'Relaystate' in the response which was sent
earlier(secodn tab).
    which is incorrect 'relaystate'. I want the relaystate to be send
properly(1st tab -> 1st relaystate), because i depends on this relay state
to get some stored values.
    How can i achieve this?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150219/873c857d/attachment.html 


More information about the users mailing list