5

I am using SimpleSAMLphp as an Idp and Salesforce as the Sp. I have it working so that I can go to the Salesforce login page and use the additional button to logon using SSO, as per step 1 in this guide: https://salesforce-developer.net/salesforce-sso-with-simplesamlphp

However, I need to redirect the user to a specific Visualforce page. I have tried adding the attribute for the startUrl into the SAML to no avail:

<saml:AttributeStatement>
    <saml:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">
        <saml:AttributeValue xsi:type="xs:string">uid</saml:AttributeValue>
    </saml:Attribute>
    <saml:Attribute Name="startURL" NameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">
        <saml:AttributeValue xsi:type="xs:string">https://mysfdomain/myvfpage/</saml:AttributeValue>
    </saml:Attribute>
</saml:AttributeStatement>

I've also tried adding in the ssoStartPage to no avail. Any help in redirecting this to the correct page would be appreciated.

Cheers, Lee

1

You're looking for the RelayState parameter. On a successful login, the RelayState should be passed back to Salesforce. This will cause Salesforce to redirect to the correct endpoint. It took me a month to figure this out the first time we started using SSO. The RelayState will be provided from salesforce, so you just have to relay it back across the URL exactly the way you received it.

For example: https://mydomain.my.salesforce.com/apex/Page will result in a SAML request like https://adfs.contoso.com/adfs/ls/?RelayState=%2Fapex%2FPage&SAML=saml-data. Simply make sure that RelayState makes it back to salesforce.com and it'll work.

  • Thanks for the response, that all makes sense and all the documentation I've read points at this. Do you have instructions on exactly how and where to specify this in SimpleSAMLphp and/or Salesforce SSO? This is what happens when I click login currently: A post request with SAML from SF is sent to mydomain/simplesaml/saml2/idp/SSOService.php. The relay state for this request is set to '/'. A post request with SAML is then sent from SimpleSAMLphp to https:://mysfdomain/?so=mynum&RelayState=%2Fapex%2Fpllpt. This just fails to login and I've not had any other luck. Cheers, Lee – Lee Mar 12 '15 at 10:54
  • Forgot to mark this as the answer. I did have to manually adjust the SimpleSAML core however in order for the relay state to be passed back to Salesforce correctly, once this was done it was redirecting fine. – Lee Mar 27 '15 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.