<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8">

</head>

<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">

<div class="">Hello,</div>

<div class=""><br class="">

</div>

I captured HTTP headers and didn’t see Relay state was sending back to SP.  Is this the issue with IDP or issue with our IDP configuration or issue with SP configuration? 

<div class=""><br class="">

</div>

<div class="">Request sent from SP to IDP</div>

<div class="">

<pre id="txt" class=""><b class="">GET <a href="https://shibidp-test.cit.cornell.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=http://www.webex-test.com&SAMLRequest=fZBBa4QwEIXv%2ByskdzXR1dhBhYVehPbSlh56i9mRXdDEZkbcn990TwuFXt883vvmtWSWeYXTxhf3ht8bEifJbZkdwf3SiS048IauBM4sSMAW3k%2BvL1BkEtbg2Vs%2Fi8Pw3Akqjmdd16hKPepG1sZOtbIF6vFpbLRW5VlPxaRNM4nkEwNdvetEjBHJQLTh4IiN4yhJVaeySUv5oY5QVSCrL9Ef2l8guFvDA%2BL%2FhIYIA8cm0V%2BYV8jzfd%2BzHUe8pRyfzaxf2vwhOfbkfzfpfwA%3D&RelayState=s2ebbefe51f5ffa1cf9fdc144376ee92080ba0302b" class="">https://shibidp-test.cit.cornell.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=http://www.webex-test.com&SAMLRequest=fZBBa4QwEIXv%2ByskdzXR1dhBhYVehPbSlh56i9mRXdDEZkbcn990TwuFXt883vvmtWSWeYXTxhf3ht8bEifJbZkdwf3SiS048IauBM4sSMAW3k%2BvL1BkEtbg2Vs%2Fi8Pw3Akqjmdd16hKPepG1sZOtbIF6vFpbLRW5VlPxaRNM4nkEwNdvetEjBHJQLTh4IiN4yhJVaeySUv5oY5QVSCrL9Ef2l8guFvDA%2BL%2FhIYIA8cm0V%2BYV8jzfd%2BzHUe8pRyfzaxf2vwhOfbkfzfpfwA%3D&RelayState=s2ebbefe51f5ffa1cf9fdc144376ee92080ba0302b</a> HTTP/1.1

</b><b class="">Host</b>: <a href="http://shibidp-test.cit.cornell.edu" class="">shibidp-test.cit.cornell.edu</a>

<b class="">User-Agent</b>: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45</pre>

<div class=""><b class="">parameters:</b></div>

</div>

<div class="">

<pre id="txt" class=""><b class="">GET

</b><b class="">providerId</b>: <a href="http://www.webex-test.com" class="">http://www.webex-test.com</a>

<b class="">SAMLRequest</b>: fZBBa4QwEIXv+yskdzXR1dhBhYVehPbSlh56i9mRXdDEZkbcn990TwuFXt883vvmtWSWeYXTxhf3ht8bEifJbZkdwf3SiS048IauBM4sSMAW3k+vL1BkEtbg2Vs/i8Pw3Akqjmdd16hKPepG1sZOtbIF6vFpbLRW5VlPxaRNM4nkEwNdvetEjBHJQLTh4IiN4yhJVaeySUv5oY5QVSCrL9Ef2l8guFvDA+L/hIYIA8cm0V+YV8jzfd+zHUe8pRyfzaxf2vwhOfbkfzfpfwA=

<b class="">RelayState</b>: s2ebbefe51f5ffa1cf9fdc144376ee92080ba0302b</pre>

<div class="">Request from IDP to SP</div>

</div>

<div class="">

<pre id="txt" class=""><b class="">POST <a href="https://cornelltest.webex.com/dispatcher/SAML2AuthService?siteurl=cornelltest" class="">https://cornelltest.webex.com/dispatcher/SAML2AuthService?siteurl=cornelltest</a> HTTP/1.1

</b><b class="">Host</b>: <a href="http://cornelltest.webex.com" class="">cornelltest.webex.com</a>

<b class="">User-Agent</b>: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0) Gecko/20100101 Firefox/45.0

<b class="">Accept</b>: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

<b class="">Accept-Language</b>: en-US,en;q=0.5

<b class="">Accept-Encoding</b>: gzip, deflate

<b class="">DNT</b>: 1

<b class="">Referer</b>: <a href="https://shibidp-test.cit.cornell.edu/idp/profile/SAML2/Unsolicited/SSO;jsessionid=A4xxxx" class="">https://shibidp-test.cit.cornell.edu/idp/profile/SAML2/Unsolicited/SSO;jsessionid=A4xxxx</a>…..</pre>

<div class=""><b class="">Parameters</b></div>

<div class="">

<pre id="txt" class=""><b class="">GET

</b><b class="">siteurl</b>: cornelltest

<b class="">POST

</b><b class="">SAMLResponse</b>: PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHNhbWwycDpSZXNwb25zZSBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9jb3JuZWxsdGVzdC53ZWJleC5jb20vZGlzcGF0Y2hlci9TQU1MMkF1dGhTZXJ2aWNlP3NpdGV1cmw9Y29ybmVsbHRlc3QiIElEPSJfYjlkMzcwZTZkOTY3MDFkMDQ1NjMyMzFmZDdmY2NlMTQiIElzc3VlSW5zdGFudD0iMjAxNi0wOC0zMFQxNDo1NToyNy42NTZaIiBWZXJzaW9uPSIyLjAiIHhtbG5zOnNhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiB4bWxuczp4c2Q9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hIj48c2FtbDI6SXNzdWVyIHhtbG5zOnNhbWwyPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5odHRwczovL3NoaWJpZHAtdGVzdC5jaXQuY29ybmVsbC5lZHUvaWRwL3NoaWJib2xldGg8L3NhbWwyOklzc3Vlcj48ZHM6U2lnbmF0dXJlIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIj4KPGRzOlNpZ25lZEluZm8+CjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CjxkczpTaWduYXR1cmVNZXRo</pre>

<div class="">didn’t see Relay state in parameters</div>

</div>

<div class=""><br class="">

</div>

<div class="">Thanks!</div>

<div class=""><br class="">

<div apple-content-edited="true" class="">

<div class="">

<div style="orphans: 2; widows: 2;" class="">Hong </div>

</div>

<div style="orphans: 2; widows: 2;" class=""><br class="">

</div>

</div>

<div>

<blockquote type="cite" class="">

<div class="">On Aug 30, 2016, at 9:59 AM, hy93 <<a href="mailto:hy93@cornell.edu" class="">hy93@cornell.edu</a>> wrote:</div>

<br class="Apple-interchange-newline">

<div class="">Hello,<br class="">

<br class="">

When SP sends relay state as parameter along with authnRequest,  after user authenticate with IDP, should IDP send relay state back in SAML assertion? How do I find the relay state in SAML assertion?

<br class="">

<br class="">

We are running IDP3. The admin of a SP said our IDP didn’t send relay state back in SAML assertion. I’m trouble shooting.<br class="">

<br class="">

Thank you for your help!<br class="">

<br class="">

Hong <br class="">

<br class="">

</div>

</blockquote>

</div>

<br class="">

</div>

</div>

</body>

</html>