In the IDP : Retrieving the URL from the SP

[Thomas Colin de Verdière]

Hello,

I have the following use case :
1. An email is send to an end user. It contains an url to connect to a web
application. The url contains a token. So suppose the domain of the web
application is sp.example.com, the url might look like :
https://sp.example.com/ABCDEFGHIJKL

sp.example.com is a Service Provider using SAML with Spring SAML.

id.example.com is an instance of Shibboleth IDP 3.

2. When the end user click on the url, he enters the SAML Authentication
process and he is redirected to the IDP. But he may not have an account. So
there is a link on the login page, that allows him to create an account.

3. The "create account" link brings him to another web application :
register.example.com
The process to create an account sends the user an email with a "validate
account" link. He must click on the link which brings him back to the
register application :
https://register.example.com/validate?some_parameters=xxxx
This creates its account.

=> Question : once the account is created i would like to send the user
back to the SAML Authentication process. Either by redirects him to the sp
initial url : https://sp.example.com/ABCDEFGHIJKL
Either by redirects him to the authentication process (is there a way to do
it ?)

How to do this ?

My first intuition was to the retrieve the HTTP Header 'referer' in the IDP
login page, but it does not work all the time. Sometimes i have the idp url
: https:/id.example.com/profile/SAML2/POST/SSO instead of the sp.

And at the beginning of the process, i may like to use relayState to pass
some sp information. May be this changes something to the possible answers

I can make any modifications i want on the IDP, the SP and the register
application.

Thank you for your answers

-- 

Thomas Colin de Verdière
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190124/ead39e45/attachment.html>