<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>
<div dir="ltr">
<div dir="ltr">Speaking as an app developer, who also maintains an IdP - my view is that you would have ToS acceptance recorded in the application.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">HTH</div>
<div dir="ltr">Dave</div>
</div>
</div>
<div id="ms-outlook-mobile-signature">
<div><br>
</div>
Sent from <a href="https://aka.ms/o0ukef">Outlook for iOS</a></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Check via users <users@shibboleth.net><br>
<b>Sent:</b> Thursday, January 2, 2025 7:52:20 PM<br>
<b>To:</b> Cantor, Scott <cantor.2@osu.edu><br>
<b>Cc:</b> Check <mrcheck@gmail.com>; Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Session/Cookie Question</font>
<div> </div>
</div>
<div>
<table border="0" cellspacing="0" cellpadding="0" align="left" width="100%">
<tbody>
<tr>
<td style="background:#ffb900; padding:5pt 2pt 5pt 2pt"></td>
<td width="100%" cellpadding="7px 6px 7px 15px" style="background:#fff8e5; padding:5pt 4pt 5pt 12pt; word-wrap:break-word">
<div style="color:#222222"><span style="color:#222; font-weight:bold">Caution:</span> Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.
</div>
</td>
</tr>
</tbody>
</table>
<br>
<div>
<div dir="ltr">
<div class="x_gmail_default" style="font-family:arial,sans-serif">You know WAY more about how all this works so I apologize for my ignorance. Maybe it's the "response location" I'm looking for and just can't find it.</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif">Let's use the Terms of Use as an example as I just tested this a few minutes ago.</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif">When I type <b>
<a href="https://mysp.com/Page1" originalsrc="https://mysp.com/Page1" shash="gvQxGIsqFejrY6hX9gq9OhSyrWIKBp1s7yJ6XPGYOjGE2rDh61GcR9/dQDAQa9Ho73SmfUygjkbo/2nkMBMq7S+1L92C/ZIN2PCDdb6X0s9fr6IG2h/6jaJ4mHd4RyNScvk1MJza8KLAoPOHRpf5zcDONgvJVrNtUqumYV0cI34=">https://mySP.com/Page1</a></b>
or <b><a href="https://mysp.com/Page2" originalsrc="https://mysp.com/Page2" shash="aJ9dou0wkAsh5xTnYYC11J9TiC9hXAIHMMy3n7KPoCPn/re26J9ZB42guzZd+1rsGROsKMN8YuXYQ4+jnPpERP7wYVn2lCOz+4Iu17YbIOQC1ma/nKYf6xY9iBNGqPZ1ySwpF5WiN+H+7YQnOk/c7umzc34m07es+pY9ehqGzXE=">https://mySP.com/Page2</a></b>,
the IdP prompts me for my cert and PIN, then takes me to the proper location, Page1 or Page2.</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif">Is Page1 or Page2 contained in the "response location"? If so, where is that saved at? Cookie? Session variable? Basically, how could I show this on the page? </div>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<blockquote style="margin:0 0 0 40px; border:none; padding:0px">
<div class="x_gmail_default" style="font-family:arial,sans-serif">"You were trying to get to
<b><a href="https://mysp.com/Page1" originalsrc="https://mysp.com/Page1" shash="sb4OYOG6xDFdOQMLoQ0R73UhGwayz9SMBgLUaMaB7q0N8bLBMCiInqNWCgsA/FJVthn6RvmjLR1/R2ySKhkDC9hdRmwdgkSPrwX/A2wKoTIdY3ImoCZy84vW/5Z+uocrgydv+yrJx3IrCHVGeRoprvdR3HadBdKNQA9+SRAMEQM=">https://mySP.com/Page1</a></b>.
To do so, you must first accept our Terms of Use."</div>
</blockquote>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif">If it's saved somewhere else, where is that somewhere else?</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif">Thanks a bunch,</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif">Robert "Check" Adamczyk</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif"><br>
</div>
<div class="x_gmail_default" style="font-family:arial,sans-serif">
<div class="x_gmail_default"></div>
</div>
</div>
<br>
<div class="x_gmail_quote x_gmail_quote_container">
<div dir="ltr" class="x_gmail_attr">On Thu, Jan 2, 2025 at 1:30 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
> How does it know where the user was heading to?<br>
<br>
It doesn't, that's all up to the SP to handle. The things an IdP knows are the identity of the SP, the response location (from the metadata), and the state token, which is opaque.<br>
<br>
Of those, the identity of the SP is the only relevant bit that can be used in any sort of "what was the user trying to do?" sense.<br>
<br>
-- Scott<br>
<br>
<br>
</blockquote>
</div>
</div>
</div>
<img src="https://www.yorksj.ac.uk/media/content-assets/safe-images/brand-guidelines/downloads/Social-Inclusion-Main-Email-Header_2024-11-25_09-03-43-949.png" alt="York St John University is the University of the Year for Social Inclusion in The Times and Sunday Times Good University Guide 2025">
</body>
</html>