Why is the relayState attribute a part of EntitySettings?

[osuvaldo90]

Perhaps it is my misunderstanding of the SAML protocol but it seems as if it would make more sense to have relayState as a parameter to createLoginRequest().

[tngan]

@osuvaldo90 I quickly review the code, in fact, right now you can pass the relayState in the entity constructor.

const sp = serviceProvider({
  relayState: ...
});

[osuvaldo90]

Thanks @tngan. My concern is mainly with using RelayState to communicate back to my service provider what the user wanted to do before being redirected to the identity provider. The fact that relayState has to be specified in the ServiceProvider constructor means I have to create a new instance of ServiceProvider for every request which involves parsing the XML metadata. While the XML is small it seems wasteful and potentially inefficient to do this for every request with a large enough number of requests per second.

Additionally, I began working on a solution to #157 and encountered the following TypeScript error when attempting to pass in relayState to the ServiceProvider constructor:

Object literal may only specify known properties, and 'relayState' does not exist in type 'ServiceProviderSettings'.

const sampleRelayState = 'SampleRelayState'

const spNoAssertSignCustomConfig = serviceProvider({
  ...defaultSpConfig,
  metadata: spmetaNoAssertSign,
  signatureConfig: {
    prefix: 'ds',
    location: { reference: '/samlp:Response/saml:Issuer', action: 'after' },
  },
  relayState: sampleRelayState
});

[osuvaldo90]

The SAML 2.0 Wikipedia page seems to imply that RelayState is certainly a property of the login request and response flow rather than the ServiceProvider as a whole.

[tngan]

@osuvaldo90

Sorry for the late reply. Thanks for catching this. Yes, it would be good to move it into request level instead of entity level.

[eliasson]

I monkey patch the entitySetting prior to the call (to avoid recreating the sp object), is there any implications on doing this as a workaround?

sp.entitySetting.relayState = "http://example.com";
sp.createLoginRequest(idp, 'redirect');

(omitted code for restoring relayState value)

Would a change to move this to a parameter for createLoginRequest instead be a good entry-level feature for a contributor?

Thanks!

[tngan]

@eliasson Yes, this is a mistake when I have designed the interface. I will find a way to put it back to request level.

[perbergland]

I was just looking for a way to pass a returnurl to the login request and the relay state seems like what people use. Is there any progress on this since the last comment? I assume it’s not an easy fix

[ghost]

@tngan Is there any progress on this issue?

[ABitShift]

Do you need help implementing this ?

[tngan]

@ABitShift Yes, feel free to submit a PR, thanks for recalling this.