<div dir="ltr">Thanks Scott. Your last point is a good point.<div><br></div><div>I have a couple of follow up questions.</div><div><br></div><div>You state that "<span style="font-family:arial,sans-serif;font-size:13px">any information in the request to </span><span style="font-size:13px;font-family:arial,sans-serif">the IdP is accessible from the login context via the API</span>". Looking at the API, loginContext.getProperty seems to be the only thing that would make sense of where I might pull request information. (1.) Would the original request params be in here?</div>
<div><br></div><div>If I added a 'target' param to my <span style="font-size:13px;font-family:arial,sans-serif">/idp/profile/SAML2/</span><span style="font-size:13px;font-family:arial,sans-serif">Unsolicited/SSO request, it seems like that gets saved off as the relayState for user later when building the SAML message. I could embed the key param into the relayState, but I wouldn't want to pass that to the SP. (</span><span style="font-family:arial,sans-serif;font-size:13px">2.) Is there a way to extract the relayState, then alter it for the duration of the request?</span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><font face="arial, sans-serif">As I slowly start drifting away from the "correct" solution... a filter seems like an option. Before the redirect, alter the redirect URL to append the 'key' param. Despite making my skin crawl, a hack solution is better than no solution. (3.) Is there any technical reason you can think of that would make this impossible?</font></div>
<div><font face="arial, sans-serif"><br></font></div><div><font face="arial, sans-serif"><br></font></div><div><span style="font-size:13px;font-family:arial,sans-serif">#SadSadTears</span></div><div><span style="font-size:13px;font-family:arial,sans-serif"><br>
</span></div><div><br></div><div><br></div><div><br></div><div><br></div><div class="gmail_extra"><br><br></div></div>