[Security Solution] - Problem using RelayState in IdP-Initiated Flow #115216
Labels
bug
Fixes for quality problems that affect the customer experience
Team:Security
Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!
triage_needed
Describe the bug:
As I described here I set up Elastic/Kibana Relying Party (RP) as a SAML Service Provider (SP) and a custom SAML Identity Provider (IdP). Both IdP and SP flows work fine, however I need to redirect the user to specific dashboards in Kibana, from my IdP.
By reading this and this I thought I could do that just by adding a RelayState to my "IdP initiated SAML Response" with the appropriate deeplink to one of my Kibana's dashboards.
What I get instead is Kibana making a GET request to it's ACS url and appending the RelayState's deeplink in the end, after my IdP gets redirected to {kibana_url}/api/security/saml/call.
Kibana/Elasticsearch Stack version:
7.15
Server OS version:
Windows 10
Browser and Browser OS versions:
Firefox, Edge, Chrome
Elastic Endpoint version:
I don't know.
Original install method (e.g. download page, yum, from source, etc.):
Download page.
Functional Area (e.g. Endpoint management, timelines, resolver, etc.):
I don't know.
Steps to reproduce:
Current behavior:
After IdP initiated flow with RelayState, Kibana tries to make a GET request do it's ACS url with RelayState's deeplink appended to it.
Expected behavior:
Kibana redirects to deeplink.
Screenshots (if relevant):
Errors in browser console (if relevant):
Provide logs and/or server output (if relevant):
Any additional context (logs, chat logs, magical formulas, etc.):
I'm quite new to SAML, did I understand the purpose of RelayState wrong? This is the definition I read:
Any help will be highly appreciated
The text was updated successfully, but these errors were encountered: