Problem URL with # on login shibboleth

[Peter Schober]

* Teresa Fasano <t.fasano at cineca.it> [2015-07-29 15:00]:
> When the user needs to log on  to the IDP it is redirected to https://<url>,
> losing all part of the url after "#".
> Instead, if the user is already logged on the IDP it is correctly redirected
> to the original URL, including the character "#".

Re-reading this you're saying that the SP keeps the "correct" (incl
the fragment identifier) URI if the browser has an SSO session at the
IDP, but the URI is missing the fragment identifier if I have to enter
credentials at the IDP?

I don't see how that's possible. The data sent and received from the
SP to the IDP and back would be the same (modulo differences wrt
Assertion/@IssueInstant and AuthnStatement/@AuthnInstant, which should
be irrelevant to this behaviour) whether I had to authenticate with
the IDP or had an SSO session established with the IDP earlier.

Also, since the SP doesn't know whether my browser will experience SSO
at the IDP or not, it would need to perform the same steps to save off
the accessed URI and reference it in the RelayState sent to the IDP.
-peter