RelayState is an URL parameter used for data exchange between the Service Provider (SP) and the Identity Provider (IDP). It specifies the URL to which the Service Provider (SP) should redirect the user once the authentication process is complete during the SAML exchange.
In other words, the RelayState value is usually a URL or other data that the service provider like to receive after the completion of the SAML flow.
If the relay state differs: In case if the relay state differs from the known relay state of the service provider, an error occurs.
If the real state is empty: In case of empty real state the service provider uses the default application path.
Example:
Suppose an Identity Provider (IDP) displays a portal page containing four different links. Each link directs to a different page within the same Service Provider (SP) website.
The Identity Provider includes the URL of one of these pages as the relay state when sending the SAML response. Once the automatic login process is complete the Service Provider instead of redirecting to a default page, redirects to the page specified by the relay state.
In short RelayState parameter is an opaque identifier that is returned without any modification or inspection.
Security Assertion Markup Language (SAML)
The Security Assertion Markup Language (SAML) ensures the smooth exchange of data between a service provider and an identity provider. The RelayState is an optional parameter in SAML requests or responses.
It is used to maintain state information during the SAML authentication flow. By including RelayState parameter, the SAML protocol enables the service provider to store the user's context or session information during the authentication process, ensuring a seamless user experience.
Difference between IDP-Initiated and SP-Initiated authentication flow:
SP Initiated:
In an SP-initiated authentication flow, when you log in to the Service Provider URL, the SP sends a RelayState parameter, and the IDP returns the exact same relay state as sent by the SP. This is important because the Identity Provider can serve more than one SP, allowing it to identify the sender of the request.
IDP-Initiated:
In the IDP-Initiated flow, you enter the IDP URL directly in the browser, and therefore the IDP is unaware of who is sending the SAMLRequest. This is where the saml2sp tool becomes useful.
How it works?
When a user initiates a request to access a service, the service provider includes the RelayState parameter in the authentication request sent to the identity provider.
The identity provider then includes the same RelayState value in its response allowing the service provider to maintain the context or state associated with the original request.
The RelayState value can be used to store information such as the user's session, the URL to which the user should be redirected after authentication, or any other relevant data. To ensure integrity and prevent tampering, it is commonly encrypted or signed.
In the context of AS ABAP, configuring RelayState involves setting up the appropriate parameters in the SAML Service Provider configuration.
Steps to configure RelayState on AS ABAP:
- Log into your AS ABAP system using an appropriate user with administrative rights. Go to transaction SAML2 from AS ABAP through SAP GUI.
- Launch the SAP NetWeaver Administrator (NWA) web interface.
- Navigate to Configuration -> Identity Provider Configuration.
- Select the relevant SAML configuration or create a new one if required.
- Look for a field called "RelayState" or something similar. This field allows you to specify the value that should be used as the RelayState parameter during SAML exchanges.
- Enter the desired value or URL in the RelayState field. Make sure the value is meaningful and relevant to your application.
- Save the configuration changes.
It is important to note that some steps and terminology may vary depending on the version of AS ABAP you are using. It is advisable to refer to the official documentation or seek guidance from your system administrator or SAP support regarding the particular version you are working with.