Relaystate functionality on shibboleth IdP side

[Surinaidu Majji]

We have an application which is integrated with shibboleth IDP(2.4.0) to
provide SSO Solution. I am using 'externalAuth' Login handler to
authenticate. Here my application is communicating
two times with Shibboleth Idp.

1) When the user try to access to one of our application(SP), We just
prepare a Saml request,Relaystate and send it to the IDP, then
it will execute the externalAuth handler and display the login page to the
user.

Relaystate preparation:

                long time = System.currentTimeMillis();
String relayState = Base64Support.encode((time + "").getBytes(),true);
relayState = "ss:mem:" + relayState;

Question: How this relaystate will be used at Shibboleth IdP side? will it
be stored in cookie?


2) Again we are redirecting to the idp, once the credentials are enterd by
user in login page validated against our database, then the
idp is giving saml response and "relaystate" which we have sent in the
above step.

Question: Why shibboleth IdP is sending "relaystate" as a part of response,
what is the main intention of that?



I have gone through the shibboleth documention but i am not able to get a
clear picture of this *relaystate*. Please
clarify my doubts about "relaysate".
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151012/2aa0dcd6/attachment.html>