Closed
Description
Describe the bug
RelayState Param with SamlLogoutRequest is ignored.
Instead its replaced with a hardcoded UUID and cannot be customized.
To Reproduce
If we call for example the logout api via: http://logout-host:1234/logout?RelayState=http://app-host:5678
the RelayState Param is never processed.
final class OpenSamlLogoutRequestResolver {
..
String relayState = UUID.randomUUID().toString();
Expected behavior
RelayState should processed or at least be customizable via
@Bean
Saml2LogoutRequestResolver logoutRequestResolver(
RelyingPartyRegistrationResolver registrations) {
OpenSaml4LogoutRequestResolver logoutRequest =
new OpenSaml4LogoutRequestResolver(registrations);
logoutRequest.setRelayStateResolver(this::resolveCustomRelayState);
return logoutRequest;
}
Solution
The solution should be very similar to #11065