Can the IdP decide where to redirect browser after login?

[Peter Schober]

* SAMUELE RILLI <samuele.rilli at unicam.it> [2016-12-19 13:05]:
> Is it possible for the IdP to set the redirect location once the authn is
> complete?
> Basically, I'd like to have user redirected after his session is created at
> the sp:
> user -> sp -> authenticate against idp -> consume assertions at the sp ->
> get redirected at url that idp chooses.

The SP does that by default (and it's the SP that knows where the
subject wanted to go, not the IDP). Is that not happening or not
working as expected in your deployment?

Or are you asking whether the IDP can overrule/override what the SP
sent?
To the latter: If the SP sends a RelayState to the IDP then the IDP
must return that value to the SP verbatim, it's not allowed to change
it.
-peter