Login target url parameter limit

[Rod Widdowson]

> It is actually our DS that is making redirection and not shibboleth SP (I checked that now with samltracer).
> As we use simplesamlphp for DS I will have to look for answer there.

If a DS is using the discovery protocol then that’s wrong.  The DS redirects back to the SP which then sends a fully fledged request to the IdP.  A discovery thing which then directs off to the IdP itself is really more like the old style WAYFs and (iirc) has to rely on nonstandard end points on the IdP to work.  Plus of course the risk of being and open redirector, which tends to be frowned upon.

FYIO

Rod