Sending a user bac to the discovery service from my IDP login page

[Wessel, Keith]

Hi, all,

I'm working on adding a link to our IDP login page that, if a user chooses the wrong campus from the discovery service, will return them to the discovery service with their previous selection clearned. This means being able to pass back the parameters to the discovery service (entityID and return). This might not be possible. The plan, if I can do it, is to reconstruct the discovery service URL and send it along to the DS page used to clear previous choices as the returnTo parameter. The remembered selection will be clared, then the user redirected on.

Best I've come up with so far is to use the referrer. If they incorrectly selected their campus in the immediate past click, which I can probably verify with a little sanity checking on the vaule of the referrer, this will, in fact, return them to the discovery service to try again.

If, on the other hand, they told the discovery service to remember their campus before the last click, the referrer will most likely be the page on the SP that' they're currently trying to log into. Still not a bad thing as I'll be clearing their remembered selection before sending them back to the SP where they can just click login or do whatever they did there before.

I know referrer can be faked, but since they won't see the IDP's login page unless it's accompanied by a valid, signed sqml request. Or is it? I suppose IDP-initiated SSO might rain on my parade.

Can anyone suggest anything more sane/reliable/secure than trying to use the referrer? I can get the entityID, obviously, but the return parameter, shy of the referrer, seems like an impossibility.

Thanks for any thoughts,
Keith