Session/Cookie Question

[Cantor, Scott]

> it shows me the Terms of Use page. I click a checkbox, then
> Submit, and it takes me to https://mySP.com/Page1

No, "it" doesn't, that's what I keep telling you. The IdP (which is the "it" in this discussion) sends a SAML response to the SP's ACS location and then the SP does whatever it does. That's largely out of scope, both of the standard and certainly of the IdP.

Naturally, the SP Is in most cases (assuming success) intending to recover the page identity and send you there, but that's nothing to do with any standards or defined anywhere and not part of the IdP.

The only thing the IdP gets is a state token, and it returns the token. There is not meant to be a URL in that token, and there usually isn't.

Basically you're observing behavior from two independent software components (plus web servers, etc.) and ascribing all of the behavior to only one of them. The part you're asking about is handled by the other one.

-- Scott