Getting the Destination URL for a scripted attribute?

[Bryan K. Walton]

We have a scripted attribute, that does a few things to determine
whether a user needs second factor authentication.  It is based upon the
code example supplied by Andrew Morgan, here:

http://shibboleth.net/pipermail/users/2018-January/038921.html

Here is his code:

-------------------

     <AttributeDefinition id="needs_duo" xsi:type="ScriptedAttribute">
         <Dependency ref="ONIDLDAP" />
         <Script><![CDATA[
             logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.needs_duo");
             duoflag = "0";
             for (i=0; i < ismemberof.getValues().size(); i++) {
                 tmp = ismemberof.getValues().get(i);
                 if (tmp.toLowerCase().equals("cn=duo-opt-in,ou=duo,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu")) {
                     logger.debug("User is opted-in to Duo");
                     duoflag = "1";
                 }
             }
             rpid = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
             logger.debug("rpid=" + rpid);
            if (rpid.equals("http://people.oregonstate.edu/~morgan/CAS-1.3.4/test.php")) {
                duoflag = "1";
            }
            if (rpid.equals("http://people.oregonstate.edu/~morgan/simplesaml/module.php/saml/sp/metadata.php/default-sp")) {
                duoflag = "1";
            }
             needs_duo.addValue(duoflag);
             logger.debug("needs_duo final value: " + needs_duo.getValues().get(0));
         ]]></Script>
     </AttributeDefinition>

-------------

This code works well for us, setting the duoflag for certain users and/or
entityIDs.

We also have a case where we have one web site that we want to exempt from
second factor auth, even though it is on an SP where the other web sites
do require MFA.

Therefore, I'd like to find a way to add into Andy's script a way to set
duoflag = "0" depending on the authenticated users's destination URL. 

Can somebody suggest how this code should be modified for that?  I tried
relayState, but it seems that the SP isn't passing that to the IdP.  I
also tried HttpServletRequest with the host header.  But that seemed to
supply the IdP host, rather than the user's original URL.

Thanks!
Bryan