FAQ: What Does the SAML 2.0 RelayState URL Function Do?

Version Affected: 9.2 and later

 

Overview

When setting up a SAML integration, the SAML 2.0 RelayState URL is an option available for the Authenticated User Redirect setting on the Post Authentication tab. What does this redirect actually do?
 

Answer

RelayState is an identifier for the resource at the Service Provider (SP) that the Identity Provider (IdP) redirects the user to after a successful login. SecureAuth IdP redirects to the URL it receives via the ReturnURL parameter, sent through the query string.

Most SP applications send the RelayState URL within the SAML AuthnRequest during redirection to SecureAuth. SecureAuth captures this URL, and once the user is authenticated successfully, sends the user back to it.

In the AuthnRequest from the SP, the RelayState parameter is meant to be an opaque identifier that SecureAuth passes back without modification or inspection. The SP can put whatever value it wants into RelayState, and the IdP simply echoes it back once authentication succeeds.

There is also a de facto standard for RelayState when using IdP-initiated login. In that case, there is no incoming AuthnRequest from the SP, so there is no state to relay back. Instead, RelayState is used by the IdP to tell the SP which URL to redirect the user to after a successful sign-on.
 

 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.