blocks|key|121878|text|RelayState的最初含义是SP可以将一些值与AuthnRequest一起发送到IDP，然后再将其取回。SP可以在RelayState中放入它想要的任何值，而IDP应该在响应中回显它。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|121879|121880|此RelayState参数是一个不透明的标识符，无需任何修改或检查即可传回|blockquote|121881|121882|121883|在使用Idp发起的登录时，RelayState还有另一个事实上的标准用法。在这种情况下，没有来自SP的传入请求，因此可能没有要中继回的状态。相反，IDP使用RelayState向SP+发信号通知SP在成功登录后应将哪个URL重定向到。在标准(Bindings+4.1.5)中，声明RelayState“可以是服务提供者处的资源的URL”。|BOLD|121884|看起来谷歌正在使用RelayState作为目标网址，甚至在SP发起的登录上也是如此，这是完全没有问题的。但IDP应该，正如文档所说，只需将其转发回来。|121885|entityMap^0|0|A|P|C|1N|A|0|0|1|A|0|0|0|D|A|26|A|2K|O|0|9|A|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]|$9|V|A|W|B|C]|$9|X|A|Y|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|Z|8|@]|D|@]|E|$]]|$1|G|3|H|5|I|7|10|8|@$9|11|A|12|B|C]]|D|@]|E|$]]|$1|J|3|-4|5|6|7|13|8|@]|D|@]|E|$]]|$1|K|3|-4|5|6|7|14|8|@]|D|@]|E|$]]|$1|L|3|M|5|6|7|15|8|@$9|16|A|17|B|C]|$9|18|A|19|B|C]|$9|1A|A|1B|B|N]]|D|@]|E|$]]|$1|O|3|P|5|6|7|1C|8|@$9|1D|A|1E|B|C]]|D|@]|E|$]]|$1|Q|3|-4|5|6|7|1F|8|@]|D|@]|E|$]]]|R|$]]

The original meaning of <code>RelayState</code> is that the SP can send some value to the IDP together with the <code>AuthnRequest</code> and then get it back. The SP can put whatever value it wants in the <code>RelayState</code> and the IDP should just echo it back in the response.
<blockquote>
This <code>RelayState</code> parameter is meant to be an opaque identifier that is passed back without any modification or inspection
</blockquote>
There is also another, de facto standard use for <code>RelayState</code> when using Idp-initiated log on. In that case, there is no incoming request from the SP, so there can be no state to be relayed back. Instead, the <code>RelayState</code> is used by the IDP to signal to the SP what URL the SP should redirect to after successful sign on. In the standard (Bindings 4.1.5) it is stated that RelayState &quot;MAY be the URL of a resource at the service provider.&quot;
It looks like Google is using <code>RelayState</code> for the target URL even on SP-initiated sign on, which is perfectly fine. But the IDP should, as the documentation says, just relay it back.

blocks|key|2677287|text|RelayState是身份提供商(在成功登录后)将用户重定向到的SP上的资源的标识符。这是一种使单点登录过程对用户来说更加短暂的方法，因为用户会再次被重定向到它们最初在SP处请求的相同页面。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2677288|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

RelayState is an identifier for the resource at the SP that the IDP will redirect the user to (after successful login). It is a way to make the process of SSO more transient to the user because they are redirected again to the same page they originally requested at the SP.

blocks|key|123903|text|根据官方SAML文档，|type|unstyled|depth|inlineStyleRanges|entityRanges|data|123904|123905|某些绑定定义了一种"RelayState“机制，用于保存和传递状态信息。当这种机制作为SAML协议的初始步骤用于传送请求消息时，它对随后用于传送响应的绑定的选择和使用提出了要求。也就是说，如果SAML请求消息伴随着RelayState数据，那么SAML响应器必须使用也支持RelayState机制的绑定返回其SAML协议响应，并且必须将与请求一起接收的确切RelayState数据放入响应中相应的RelayState参数中。|blockquote|123906|123907|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|J|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|K|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|L|8|@]|9|@]|A|$]]|$1|G|3|-4|5|6|7|M|8|@]|9|@]|A|$]]]|H|$]]

As per official SAML document,

<blockquote>
 Some bindings define a "RelayState" mechanism for preserving and conveying state information. When
 such a mechanism is used in conveying a request message as the initial step of a SAML protocol, it
 places requirements on the selection and use of the binding subsequently used to convey the response.
 Namely, if a SAML request message is accompanied by RelayState data, then the SAML responder
 MUST return its SAML protocol response using a binding that also supports a RelayState mechanism, and
 it MUST place the exact RelayState data it received with the request into the corresponding RelayState
 parameter in the response.
</blockquote>

blocks|key|2888840|text|下面的流程图可能会一步一步地帮助你。ACS+URL和relayState都不同。relayState为你提供了更多的信息/url来处理用户想要去的地方。more+details|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2888841|​|2888842|📷|atomic|2888843|2888844|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/GluuFederation/tutorials/blob/master/oidc-sso-tutorials/tutorials/SAML-SSO-with-Gluu-Shibboleth-IDP-Initiated-Flow.md|1|IMAGE|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/4026307ac43a938d9049c4560214687e.png|imageAlt^0|24|C|0|0|0|0|1|1|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@$A|Y|B|Z|1|10]]|C|$]]|$1|D|3|E|5|6|7|11|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|12|8|@]|9|@$A|13|B|14|1|15]]|C|$]]|$1|I|3|E|5|6|7|16|8|@]|9|@]|C|$]]|$1|J|3|-4|5|6|7|17|8|@]|9|@]|C|$]]]|K|$L|$5|M|N|O|C|$P|Q]]|R|$5|S|N|T|C|$U|V|W|-4]]]]

This below flow diagram may help you step by step. ACS URL and relayState both are different. relayState gives you one more info/url to handle where exactly user want to go. <a href="https://github.com/GluuFederation/tutorials/blob/master/oidc-sso-tutorials/tutorials/SAML-SSO-with-Gluu-Shibboleth-IDP-Initiated-Flow.md" rel="nofollow noreferrer">more details</a>
<a href="https://i.stack.imgur.com/Jy8Pz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Jy8Pz.png" alt="saml-sso-idp-initialted-flow-relay-state" /></a>

I am trying to understand SSO using SAML. I have come across the RelayState parameter and am very confused exactly why it comes first in SSO to send encoded URLs? What exactly does it mean?

Please read the following from <a href="https://developers.google.com/google-apps/sso/saml_reference_implementation" rel="noreferrer">the Google Developer documentation</a>:

<blockquote>
 Google generates a SAML authentication request. The SAML request is encoded and embedded into the URL for the partner's SSO service. The RelayState parameter containing the encoded URL of the Google application that the user is trying to reach is also embedded in the SSO URL. This RelayState parameter is meant to be an opaque identifier that is passed back without any modification or inspection
</blockquote>

What is exactly RelayState parameter used in SSO (Ex. SAML)?

身份验证

单点登录

我正在尝试使用SAML来理解SSO。我遇到了RelayState参数，并且非常困惑为什么它在单点登录中首先发送编码的URL？这到底是什么意思？请从阅读以下内容SAML生成一个身份验证请求。SAML请求被编码并嵌入到合作伙伴的SSO服务的URL中。包含用户试图访问的Google应用程序的编码URL的RelayState参...

问单点登录中使用的RelayState参数到底是什么(例如：SAML)？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问单点登录中使用的RelayState参数到底是什么(例如：SAML)？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问单点登录中使用的RelayState参数到底是什么(例如：SAML)？
EN