For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

schmuck's avatar
schmuck
Icon for Nimbostratus rankNimbostratus
Dec 26, 2015

SP initiated login to Salesforce ignoring RelayState

The SAML configuration is in place and everything is working for IdP initiated. SP initiated however, simply directs users to the default F5 APM Webtop. The process ignores the RelayState parameter that is sent by the Service Provider (Salesforce.com). Salesforce is sending a URI as a RelayState parameter. So, it can be "/", "/00O/o" or some crazy long string. F5 will always send the user to the webtop. Using Fiddler, you can see that there is always a RelayState sent but the F5 always ignores it. Is there some way to manipulate this to have the HOST included in the parameter? Is there something mis-configured? Is this an SF or F5 issue?

 

BIG-IP Access Policy Manager (APM)
security

1 Reply

  • schmuck's avatar
    schmuck
    Icon for Nimbostratus rankNimbostratus
    Jan 01, 2016

    Looks like the issue was with the configuration on the Service Provider. The login URL was not configured as the F5 standard one, The RelayState was fine and never changed but after the login was configured to the above (on the SP), the RelayState was processed properly and everything just worked.