Passing context/state to a SAML service provider

Question

I'm using salesforce as an identity provider through a connected app link in my community. The service provider is a .NET application that downloads a lot of files. I've got the .NET application working with Salesforce as the identity provider using the sustainsys SAML2 library. Now I want to I'm trying to pass URL variables through the connected app, but nothing shows up in the service provider. The custom identity variables pass through on the identity object just fine.

https://{salesforceURL}?app={connectedAppId}&thisVar=123&otherVar=456

thisVar and otherVar are blank and the service provider URL is only

https://{serviceProviderURL}

What do I need to do to pass through URL variables using a connected app like this?

https://{serviceProviderURL}&thisVar=123&otherVar=456

Answer 1

In SAML, RelayState is used for passing state between identity and service provider. In identity provider-initiated flow, you construct the link by taking the value of IdP-initiated Login URL field from the connected app and appending RelayState to it as a query parameter.

• IdP-initiated Login URL is https://blah.my.salesforce.com/idp/login?app=0sp...
• IdP-initiated Login URL with RelayState is https://blah.my.salesforce.com/idp/login?app=0sp...&RelayState=%2Fmy%2Fapp%2Fpage

The value of RelayState should be URL-encoded. The interpretation of the RelayState and the resulting action is up to service provider. A typical implementation expects the RelayState to be a relative URI that tells the service provider to land the user on the certain page in your target application. The example above uses /my/app/page as the value.

Answer 2

The Sustainsys SAML library requires an attribute relayStateUsedAsReturnUrl="true" to be added to the web.config in order to return the RelayState on the URL. This configuration is not documented.