<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>Attributes and forwarding to Relay state</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">Hello,</FONT>
<BR><FONT SIZE=2 FACE="Arial">Is there a way that an attribute consumed from the saml assertion can be added to the request that is forwarded to the url in the relay state? The url in the relay state is on a different domain than the sp.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Some background:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">We are creating a sp (sp.example.com) to process unsolicited idp requests from our client. The request will contain a saml response and a relay state to our struts web app (fooX.bar.com). The sp is not authenticating the user, just validating that the saml request did come from the client before forwarding the request to the relay state url. The url in the relay state could be different (foo1.bar.com, foo2.bar.com,etc) depending on the client type. The saml assertion contains a custom attribute called 'payload' that contains confidential client information. Our web application on fooX.bar.com needs that client information to lookup the client in our db.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Are the attributes added to the session that is created by the sp? Is this session forwarded to the relay state url even if they are on separate domains?</FONT></P>
<P><FONT SIZE=2 FACE="Arial">My apologies if I've missed documentation that answers this question.</FONT>
<BR><FONT SIZE=2 FACE="Arial">Thanks.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Chris</FONT>
</P>
</BODY>
</HTML>