Can Cognito accept url-based RelayState from Client IdP?

Question

I have a client who is currently set up for SP-initiated SSO with Amazon Cognito, but the client has also requested IdP-initiated SSO. In the past, with other IdPs, we've used the standard RelayState string for IdP-initiated flows.

```
identity_provider=&client_id=&redirect_uri=&response_type=code&scope=openid+email+phone
```

However, the client is using Ping Identity as their IdP and, as a rule, it does not support passing strings in the TargetResource parameter ([which is how they pass the RelayState](https://support.pingidentity.com/s/article/SAML-RelayState-and-PingFederate)). They would like to pass a URL in the RelayState instead of a standard string.

Can Cognito be configured to accept a URL in the RelayState during an IdP-initiated SSO flow. If so, how can this be set up and how can I determine what that url should be?

Thanks in advance!

Jainam · Answer

Hi,

For handling URL-based RelayState with Cognito and Ping Identity IdP-initiated SSO, here's what you need to know:

1. Cognito SAML Configuration:
```json
{
  "RelayState": {
    "mappings": {
      "url": "https://your-app-domain/callback"
    }
  }
}
```

2. Expected URL format:
```
https://your-cognito-domain/saml2/idpresponse?RelayState=https://your-app-domain/callback
```

3. Configure Ping Identity:
```
Target Resource URL: https://your-cognito-domain/saml2/idpresponse
RelayState URL: https://your-app-domain/callback
```

Key Points:
- Cognito accepts URL-based RelayState parameters
- URL must be properly encoded
- RelayState URL should match your app's callback URL
- Configure allowed callback URLs in Cognito app client settings

For more details:
- [Cognito SAML Configuration](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.html)
- [IdP-initiated Authentication Flow](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation.html)

Can Cognito accept url-based RelayState from Client IdP?

Add your answer

Relevant content