<div dir="ltr">Hi,<div><br></div><div>We got IdP 3.3. with CAS plugin</div><div><br></div><div>We got existing IdP intiated URLs as below</div><div><br></div><div><p class="MsoNormal"><span lang="EN-US"><a href="https://idpweb1.vu.edu.au/idp/profile/SAML2/Unsolicited/SSO?providerId=https://askvu.vu.edu.au/cgi-bin/askvu.cfg/php/admin/sso_launch.php?p_subject=Account.Login&target=https://askvu.vu.edu.au/AgentWeb/">https://myidp.com/idp/profile/SAML2/Unsolicited/SSO?providerId=https://vendor.com/cgi-bin/?p_subject=myAccount</a></span></p><p class="MsoNormal"><br></p><p class="MsoNormal"><br></p><p class="MsoNormal">Then I changed it to below</p><p class="MsoNormal"><br></p><p class="MsoNormal"><a href="https://idpweb1.vu.edu.au/idp/profile/SAML2/Unsolicited/SSO?providerId=https://askvu.vu.edu.au/cgi-bin/askvu.cfg/php/admin/sso_launch.php?p_subject=Account.Login&target=https://askvu.vu.edu.au/AgentWeb/">https://myidp.com/idp/profile/SAML2/Unsolicited/SSO?providerId=https://vendor.com/cgi-bin/?p_subject=myAccount&target=https://vendortarget.com/AgentWeb/</a><br></p><p class="MsoNormal"><br></p><p class="MsoNormal"><br></p><p class="MsoNormal">however when I it initially redirect to CAS for the authentication, I am able to see the Service param with enitityId URL, however target param was missing on the querystring, so I had doubts.....</p><p class="MsoNormal"><br></p><p class="MsoNormal">but when I further checked the final response......</p><p class="MsoNormal"><br></p><p class="MsoNormal">I am able to see the RelayState along with the SAMLResponse as shown below.....</p><p class="MsoNormal"><br></p><p class="MsoNormal"><br></p><p class="MsoNormal">I kind of tend to believe IdP has done what it supposed to do, even though the relay state was not appearing in the query string but somehow maintained in the IdP</p><p class="MsoNormal"><br></p><p class="MsoNormal">Please let me know above understanding is correct</p><p class="MsoNormal"><br></p><pre id="gmail-txt"><b>POST
</b><b>RelayState</b>: <a href="https://idpweb1.vu.edu.au/idp/profile/SAML2/Unsolicited/SSO?providerId=https://askvu.vu.edu.au/cgi-bin/askvu.cfg/php/admin/sso_launch.php?p_subject=Account.Login&target=https://askvu.vu.edu.au/AgentWeb/" style="font-family:arial,sans-serif;white-space:normal">https://vendortarget.com/AgentWeb/</a>
<b>SAMLResponse</b>: PD94bWwgdmVyc2lvbj0iMS4......</pre><p class="MsoNormal"><br></p><p class="MsoNormal"><br></p><p class="MsoNormal"><br></p><p class="MsoNormal"><br></p><p class="MsoNormal"><br></p></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 28, 2017 at 6:46 PM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Lalith Jayaweera <<a href="mailto:ljayaweera@gmail.com">ljayaweera@gmail.com</a>> [2017-09-28 09:16]:<br>
<span class="">> For one of our IdP initiated SPs, there is a request to have RelayState as<br>
</span>> a specific URL [...]<br>
<span class="">> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/SHIB2/<wbr>IdPUnsolicitedSSO</a><br>
> can I safely assume, it is all about setting 'target' param in the<br>
> relyingparty xml<br>
<br>
</span>Fyi, unless you're still using IDPv2 that's not the right<br>
documentation, for IDPv3 it's here:<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/UnsolicitedSSOConfiguration" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/IDP30/<wbr>UnsolicitedSSOConfiguration</a><br>
<br>
And the documented parameters are for query strings (i.e., request<br>
parameters) for HTTP GET requests sent to the IDP:<br>
<br>
  target (optional)<br>
    Corresponds to RelayState in the SAML 2.0 protocol, but can be<br>
    omitted.<br>
<br>
So you'd set 'providerId' to the (URL-encoded) entityID of the SP and<br>
'target' to the URL you want to end up with at the SP (or the opaque<br>
RelayState value the SP wants you to use).<br>
<br>
You don't have to change any configuration files in order to use the<br>
above interface.<br>
<span class="HOEnZb"><font color="#888888"><br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</font></span></blockquote></div><br></div>