Session/Cookie Question

[Cantor, Scott]

> How does it know where the user was heading to?

It doesn't, that's all up to the SP to handle. The things an IdP knows are the identity of the SP, the response location (from the metadata), and the state token, which is opaque.

Of those, the identity of the SP is the only relevant bit that can be used in any sort of "what was the user trying to do?" sense.

-- Scott