IDP not forwarding to correct protected page

[Rod Widdowson]

By default the IdP will just send you back to where the SP told it do (indeed off the top of my head I'd not know how to make it do
otherwise) so that argues more of an issue on the SP side.

Of course someone may well have bludgeoned either side into doing the wrong thing.  If you are unsure watch the login in a tracer
(SAMLTracer in firefox is best, but any one will do).

When you go to the idp you'll see something like this:

GET https://idp./ idp/profile/SAML2/Redirect/SSO?SAMLRequest=[SNIP]
               &RelayState=ss%3Amem%3A5ff7ce7988ffbf852242301bfc815b632e2ef22aedaf8aa351532264a49b5df8

And when it sends you back you'll see a 

POST to https://issues.shibboleth.net/jira/Shibboleth.sso/SAML2/POST
With parameter
     RelayState: ss:mem:5ff7ce7988ffbf852242301bfc815b632e2ef22aedaf8aa351532264a49b5df8

That relay state thing is what tells the SP (not the IdP ) where you need to end up all the IDP is pass it back to the SP