RelayState missing in callback URL post query | okta :

[fas3r]

Hello,

I'm using Okta as SAML 2 endpoint to authenticate my user. Authentication is working as expected but I'm trying to set the "RelayState" to get the user redirected to a dynamic URL after been authenticated, but in the POST HTTP CALLBACK URL, the "RelayState" is empty in req.body even if I set it in the passport.authenticate().

app.use('/login', passport.authenticate('saml', {
failureRedirect: '/',
failureFlash: true
}));

app.post('/login/callback', (req, res, next) => {
passport.authenticate('saml',
{
failureRedirect: '/',
failureFlash: true
})(req, res, next)
}
)

Example of req.body on the post callback :

{
SAMLResponse: 'PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbDJwOlJlc3BvbnNlIHhtbG5zOn NhbWwycD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnByb3RvY29sIiBEZXN0aW5hdGlvbj0ia HR0cDovL2xvY2FsaG9zdDo4MDgwL2xvZ2luIiBJRD0iaWQ1MzM0MDQyODE4NjUyNzg3NTgyNjg5MjMi IElzc3VlSW5zdGFudD0iMjAxOC0xMS0wN1QxNToyMzoyMC45MzdaIiBWZXJzaW9uPSIyLjAiIHhtbG5zO nhzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYSI+PHNhbWwyOklzc3VlciB4bWxuczpzY W1sMj0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF................',
RelayState: ''
}

I also confirm that the req.query.RelayState is set correctly in the GET login method, with the URL where the user is suppose to be redirected.

I also tried using the additionalParams : { "RelayState" : req.query.RelayState }

I also tried with a fix value, like : 'RelayState': '/dashboard' ( for example ), and it seems that RelayState is not given to the call back URL.

Thanks by advance

BR,
fas3r.

[markstos]

Is this a bug report? Our README makes no mention of handling RelayState.

If this is a place where you believe we could include our spec compliance or implementation, please provide specific references to the sections of the SAML spec that apply here.

[cjbarth]

I did note that we do handle RelayState and I've used it successfully before, so I know it works for at least some use-cases. It does appear that we need to document it though.