<div dir="ltr"><div>Thank you Nate!</div><div><br></div><div>I am sorry, I am not sure where to add the 'target' parameter.. Is it added to the metadata or relying-party?<br></div><div><br></div><div>        <EntityDescriptor entityID="<a href="https://example.com/saml.digest">https://example.com/saml.digest</a>" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"><br>              <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><br>                       <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified</NameIDFormat><br>                        <AssertionConsumerService index="0" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href="https://example.com/saml.digest">https://example.com/saml.digest</a>" /><br>         </SPSSODescriptor><br>      </EntityDescriptor> <br></div><div><br></div><div><br></div><div><br></div><div> <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://example.com/saml.digest">https://example.com/saml.digest</a>"> <br>          <property name="profileConfigurations"> <br>              <list> <br>                  <bean parent="SAML2.SSO" <br>                                p:encryptAssertions="false" <br>                               p:includeAttributeStatement="true"<br>                       p:signResponses="false" <br>                         p:signAssertions="true" <br>                         p:nameIDFormatPrecedence="#{{'urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified'}}" /> <br>                  <ref bean="SAML2.Logout" /><br>              </list> <br>          </property> <br>    </bean> </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, 20 Aug 2020 at 21:05, Nate Klingenstein <<a href="mailto:ndk@signet.id">ndk@signet.id</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Joshua,<br>
<br>
Presuming you're using the POST binding, RelayState is a separate input element in the form(alongside the Response) that is sent from the IdP to the SP which designates the page the user is supposed to land on after processing of the assertion is complete.  It's conveyed in other ways with other bindings, but does functionally the same thing.<br>
<br>
This first hop is normally handled automatically with SP-initiated SSO(as the SP sends along what the RelayState should be in the AuthnRequest).<br>
<br>
For IdP-initiated SSO, you can add a RelayState through the "target" parameter with the Unsolicited SSO endpoint:<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP4/UnsolicitedSSOConfiguration" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP4/UnsolicitedSSOConfiguration</a><br>
<br>
I assume that you're hosting multiple links to multiple target pages behind the vendor's SP.  All navigation subsequent to the SAML transaction should be obviously happening within the vendor's site, so your IdP isn't involved in that at all.<br>
<br>
So, there's nothing to "turn on", as this is default behavior.  You probably just need to add target parameters to that bunch of links.<br>
<br>
Hope this helps,<br>
Nate.<br>
<br>
--------<br>
Signet, Inc.<br>
The Art of Access ®<br>
<br>
<a href="https://www.signet.id" rel="noreferrer" target="_blank">https://www.signet.id</a><br>
<br>
<br>
<br>
-----Original message-----<br>
> From: Joshua Brodie<br>
> Sent: Thursday, August 20 2020, 9:29 pm<br>
> To: users<br>
> Subject: IDP Initiated SSO + RelayState<br>
> <br>
> <br>
> <br>
> We have an IDP-initiated SSO to a cloud service provider.<br>
> <br>
> The vendor is saying that we have to enable RelayState on the IDP in order to allow linking to specific pages in the application (currently users after clicking on link, entering their account/password, end up in the applications home page - not the linked page).<br>
> <br>
> Any ideas what the vendor is talking about? I have never come across this.<br>
> <br>
> --<br>
> <br>
> For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
> <br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
> <br>
> <br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>