diff --git a/modules/saml/lib/Auth/Source/SP.php b/modules/saml/lib/Auth/Source/SP.php index b14fbaa2c7cd934197caab4cc4e6ced8819497fc..5acba8bd5dcb3167e23f0f766683ed572208bc7a 100644 --- a/modules/saml/lib/Auth/Source/SP.php +++ b/modules/saml/lib/Auth/Source/SP.php @@ -170,6 +170,10 @@ class sspmod_saml_Auth_Source_SP extends SimpleSAML_Auth_Source { $ar->setAssertionConsumerServiceURL(SimpleSAML_Module::getModuleURL('saml/sp/saml2-acs.php/' . $this->authId)); $ar->setProtocolBinding(SAML2_Const::BINDING_HTTP_POST); + if (isset($state['SimpleSAML_Auth_Default.ReturnURL'])) { + $ar->setRelayState($state['SimpleSAML_Auth_Default.ReturnURL']); + } + $id = SimpleSAML_Auth_State::saveState($state, 'saml:sp:ssosent-saml2'); $ar->setId($id); @@ -386,7 +390,11 @@ class sspmod_saml_Auth_Source_SP extends SimpleSAML_Auth_Source { $state['Attributes'] = $authProcState['Attributes']; if (isset($state['saml:sp:isUnsoliced']) && (bool)$state['saml:sp:isUnsoliced']) { - $redirectTo = $source->getMetadata()->getString('RelayState', '/'); + if (isset($state['saml:sp:RelayState'])) { + $redirectTo = $state['saml:sp:RelayState']; + } else { + $redirectTo = $source->getMetadata()->getString('RelayState', '/'); + } SimpleSAML_Auth_Default::handleUnsolicedAuth($sourceId, $state, $redirectTo); } diff --git a/modules/saml/www/sp/saml2-acs.php b/modules/saml/www/sp/saml2-acs.php index 3b99b0138d8d8a4d21697062f59f9af9aedc399c..49470930596a69acb2680cd0241c4c8a2f6016f5 100644 --- a/modules/saml/www/sp/saml2-acs.php +++ b/modules/saml/www/sp/saml2-acs.php @@ -28,6 +28,7 @@ if (!empty($stateId)) { $state = array( 'saml:sp:isUnsoliced' => TRUE, 'saml:sp:AuthId' => $sourceId, + 'saml:sp:RelayState' => $response->getRelayState(), ); }