'Deep linking' in Shibboleth

[Cantor, Scott]

On 1/22/16, 12:34 PM, "users on behalf of Zico" <users-bounces at shibboleth.net on behalf of mailzico at gmail.com> wrote:



>Make sense, Scott. I believe the IdP I am using supports all standing procedures. So, I am jumping into real lab work with that SP who asked for deep linking facility. Let's see where we go....

The context for your question wasn't initially clear.

I would note that while the most "simple" way of handling this is the basic hack of sending the resource URL in the RelayState field, that is frowned upon. The spec technically limits RelayState to 80 bytes, meaning an IdP could choose not to accept it, but in practice nothing much cares. Secondly, it's a privacy leak.

The accepted practice is to mask it in a state token corresponding to a cookie or some other state at the SP.

-- Scott