6

I am implementing SSO where I am the Identity Provider, right now I am able to successfully log into the Service Provider. But it takes me to the home page. I want to specify the landing page URL when I post the response. Have searched quite a lot but could not find anything convincing. Do not quite know which element of the SAML response carries the Landing page URL or is the in the form that I have to specify. Using java and opensaml libraries to generate the response.

user3391212
  • 71
  • 1
  • 1
  • 3

1 Answers1

12

Though it is not in the SAML specs, a de-facto standard is to use the RelayState element for that. It is added as a parameter in the response in addition to the SAMLResponse parameter and value of the landing URL. Sample HTML page from http://en.wikipedia.org/wiki/SAML_2.0 for an IDP using the POST binding for the response:

<form method="post" action="https://sp.example.com/SAML2/SSO/POST" ...>
    <input type="hidden" name="SAMLResponse" value="<response>" />
    <input type="hidden" name="RelayState" value="<url>" />
    ...
    <input type="submit" value="Submit" />
</form>

Edit:
Just to be clear, the RelayState parameter declaration is part of the specs and it is included to allow for passing arbitrary state between SP and IDP. Using it for passing a URL that defines the landing page is not defined in the spec but is de-facto standard usage. Any usage of RelayState in IDP-init-SSO would depend on a pair-wise agreement between IDP and SP and this is just an agreement that makes sense, is useful and thus has been widely adopted.

Hans Z.
  • 50,496
  • 12
  • 102
  • 115
  • 1
    Is it safe if I pass a non-encoded URL. The SP end gives me a "not found", guess they do not decode it at their end. But it works without encoding. – user3391212 Jan 23 '15 at 20:25
  • Sorry, I meant to say on the wire it is URL-encoded when passing it in the HTTP POST; by placing it verbatim in the HTML form, the browser will URL-encode it. So in the sample that I gave you would place the actual value in ``. I will edit the text. – Hans Z. Jan 23 '15 at 20:29
  • Not to nit-pick, but `RelayState` is absolutely in the [bindings specs](http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf) for SAML 2.0 (i.e. it is stronger than a de-facto standard). The **HTTP POST**, **HTTP Redirect**, and **HTTP Artifact** bindings all include rules for `RelayState`, though none _require_ its use. – Scott Heaberlin Jan 24 '15 at 20:55
  • 3
    `RelayState`'s name is standardized but it's value is not. – Hans Z. Jan 24 '15 at 21:51
  • updated the answer with info about that last comment – Hans Z. Jan 25 '15 at 14:20