When reauth is needed it does not carry POST/GET variables

[Peter Schober]

Dan <shibboleth at mailscan.dk> [2025-02-21 16:47 CET]:
> When I have a <form>, and my Azure session has expired, then it will
> of course reauthenticate. This happens when I have been idel for
> 60-90 minutes. The reauth is working fine, but it will not transfer
> any <form> $_POST or $_GET values to my destination page?

A properly configured SP shouldn't lose query parameters from the
RelayState if an access to the protected ressource happens but the
local SP session has expired.

(Also you should be able to configuire a session lifetime and timeout
appropriate to your use-case, community of users and risk assessment.)

So I'd start there, which requires knowledge about the protected
resource, whether it has its own session, how this interacts with the
SP session (what happens of the application's session expires but not
the SP's own session or vice versa), etc.

Once you've fixed this for GET requests with query parameters you can
move on to tackle lost HTTP POST requests to your server, see
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334342/Sessions
and start looking for "post".

HTH,
-peter