Single Sign On Deep Linking Issue - RelayState not returning from IBM TFIM

bennyb
Kilo Contributor

‎05-05-2013 04:48 PM

Hi,

thought I'd share the solution to a problem we were having with Single Sign on using SAML2 and IBM Tivoli Federated Identity Management (TFIM).

The issue was that when URLs to specific pages (deep links) within Service-Now were attempted to be navigated to, users were automatically redirected to the Service-Now homepage, as when passing through the SAML2 authentication process, the deep link would be lost.

Setting a RelayState parameter was documented to fix this issue. When we tried to append RelayState to the end of our baseUrl we found that TFIM would only return the baseURL - ie it seemed that TFIM was not reading the RelayState.

The problem turned out to be that our baseURL included the Target parameter. When leaving the Target parameter off the baseURL, RelayState was able to be returned by TFIM:


Originally, system property "glide.authenticate.sso.saml2.idp_authnrequest_url" included the parameter "Target". 



https://mycompany-idp.com?RequestBinding=HTTPPost&NameIdFormat=email&PartnerId=https://mycompany.ser...


Leaving off the Target parameter resolved the problem:



https://mycompany-idp.com?RequestBinding=HTTPPost&NameIdFormat=email&PartnerId=https://mycompany.ser...


Hope this helps others as it is not clear in IBM TFIM documenation!
0 Helpfuls
  • 4,457 Views
5 REPLIES 5

Inactive_Us2219
Kilo Contributor
In response to Inactive_Us2219

‎06-07-2019 11:05 AM

It turns out our issue was fixed by ServiceNow, but you had to update a system property to activate.

 

https://community.servicenow.com/community?id=community_question&sys_id=dd104b21db98dbc01dcaf3231f96...

 

In working the SSO, I had found that using the RelayState (TargetResource) was only working on initial connection, which was confirmed by an SN SSO SME.
 
When following up with above community article, someone just recently posted this info.
There has been a problem since Jakarta patch 6 for this where they say it's fixed.  
PRB1237672
RelayState does not maintain when IDP sends a SAML response when there is a valid session with an IDPinitiate login 
 
Also in the article was this vital info:
 In-order to activate this fix, please add/enable the following system property 
 
 System Property name: glide.authenticate.honor.relaystate.for.loggedin.sessions 
 System Property type: true|false 
 System Property value: true
 
This isn't exact issue above, but it was the fix for my issue. Thanks.
0 Helpfuls