Sending a user bac to the discovery service from my IDP login page

[Cantor, Scott]

> I know referrer can be faked, but since they won't see the IDP's login page
> unless it's accompanied by a valid, signed sqml request. Or is it? I suppose
> IDP-initiated SSO might rain on my parade.

SAML requests are rarely signed. Trying to prevent phishing in that way isn't possible. Signing requests doesn't play any role in XSRF prevention, that requires other tricks that don't require signed requests and are, yes, impossible if IdP-initiated SSO is allowed.

> Can anyone suggest anything more sane/reliable/secure than trying to use
> the referrer? I can get the entityID, obviously, but the return parameter, shy
> of the referrer, seems like an impossibility.

RelayState? Is that what you're talking about?

-- Scott