I'm using salesforce as an identity provider through a connected app link in my community. The service provider is a .NET application that downloads a lot of files. I've got the .NET application working with Salesforce as the identity provider using the sustainsys SAML2 library. Now I want to I'm trying to pass URL variables through the connected app, but nothing shows up in the service provider. The custom identity variables pass through on the identity object just fine.


thisVar and otherVar are blank and the service provider URL is only


What do I need to do to pass through URL variables using a connected app like this?

  • Is your community a Salesforce community or an outside app? It would help to understand what you're trying to achieve (see X-Y problem)
    – identigral
    Feb 5 '20 at 16:26
  • I added what the service provider does.
    – afandre
    Feb 5 '20 at 18:55

In SAML, RelayState is used for passing state between identity and service provider. In identity provider-initiated flow, you construct the link by taking the value of IdP-initiated Login URL field from the connected app and appending RelayState to it as a query parameter.

  • IdP-initiated Login URL is https://blah.my.salesforce.com/idp/login?app=0sp...
  • IdP-initiated Login URL with RelayState is https://blah.my.salesforce.com/idp/login?app=0sp...&RelayState=%2Fmy%2Fapp%2Fpage

The value of RelayState should be URL-encoded. The interpretation of the RelayState and the resulting action is up to service provider. A typical implementation expects the RelayState to be a relative URI that tells the service provider to land the user on the certain page in your target application. The example above uses /my/app/page as the value.

  • That didn't work for me.
    – afandre
    Feb 5 '20 at 22:27
  • @afandre What is your expected versus observed result when you try this
    – identigral
    Feb 5 '20 at 22:58

The Sustainsys SAML library requires an attribute relayStateUsedAsReturnUrl="true" to be added to the web.config in order to return the RelayState on the URL. This configuration is not documented.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.