<div dir="ltr"><div class="gmail_default" style="font-family:arial,sans-serif">That may be enough.  The user's browser heads to <a href="https://mySP.com/pageTheyWantToGoTo">https://mySP.com/pageTheyWantToGoTo</a>.  They get redirected to something like <a href="https://idp.com/warning.vm">https://idp.com/warning.vm</a>.  When they click a button on that page in their browser, the browser sends them back to the IDP which then sends them to <a href="https://mySP.com/pageTheyWantToGoTo">https://mySP.com/pageTheyWantToGoTo</a>.  Same thing happens with the Terms of Use one.  How does it know where the user was heading to?  Is it in a session variable?  A cookie?  It ends up taking them there so it's gotta know where they were headed. Or does it just know <a href="https://mySP.com">https://mySP.com</a> and doesn't save the whole address of <a href="https://mySP.com/pageTheyWantToGoTo">https://mySP.com/pageTheyWantToGoTo</a>?</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Thu, Jan 2, 2025 at 1:08 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> I need the warning intercept view to know where the user<br>
> was heading to when they got intercepted.<br>
<br>
If by "where" you mean something regarding the SP, there is no support in SAML (or OpenID) for knowing that information beyond the level of which SP it was (the entityID). By design the IdP isn't meant to know any more detail than that.<br>
<br>
-- Scott<br>
<br>
<br>
</blockquote></div>