feat: Support IdP-initiated SAML auth with redirect destination in RelayState - #38939
Open
jono-booth wants to merge 2 commits into
Open
feat: Support IdP-initiated SAML auth with redirect destination in RelayState#38939jono-booth wants to merge 2 commits into
jono-booth wants to merge 2 commits into
Conversation
jono-booth
changed the title
jono-booth
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for IdP-initiated SAML authentication flows to carry a post-auth redirect destination by encoding both the IdP slug and a next path into RelayState ("<idp_slug>|<next>"). The backend extracts/validates the redirect target using existing redirect-safety logic and then rewrites RelayState back to just the slug so the existing SAML provider lookup continues to work.
Changes:
- Parse combined
RelayStatevalues, validate and persist a safenextdestination in the session, and rewriteRelayStateto the IdP slug. - Harden handling of missing
RelayStateby raisingAuthMissingParameterfromMultiValueDictKeyError. - Add unit tests covering safe vs unsafe
nextvalues embedded inRelayState.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
common/djangoapps/third_party_auth/saml.py |
Adds RelayState parsing/validation and session storage for next, then rewrites RelayState back to the IdP slug. |
common/djangoapps/third_party_auth/tests/test_saml.py |
Adds unit tests for splitting RelayState and setting/dropping next based on redirect safety. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+143
to
+152
| if is_safe_login_or_logout_redirect( | ||
| redirect_to=next_decoded, | ||
| request_host=request.get_host(), | ||
| dot_client_id=(request.GET.get('client_id') if hasattr(request, 'GET') else None), | ||
| require_https=request.is_secure(), | ||
| ): | ||
| request.session['next'] = next_decoded | ||
| else: | ||
| # RelayState included an unsafe destination; clear any stale 'next' value | ||
| request.session.pop('next', None) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Backport of edx#108, originally merged to our
release-ulmorelease branch.Adds support for IdP-initiated SAML login flows (where the user doesn't first hit
/auth/login/...) to carry a post-auth redirect destination. Since some IdPs (e.g. Auth0) can only reliably influence the SAML POST viaRelayState,RelayStatemay now encode both the IdP slug and anextdestination as"<idp_slug>|<next>".SAMLAuthBackend.auth_completeextracts and validatesnext(via the existingis_safe_login_or_logout_redirectsafety check) before rewritingRelayStateback down to just the slug so the rest of the SAML pipeline continues to work unmodified.Backport notes
masterhas diverged from where this was originally written (Feb 2026):common/djangoapps/third_party_auth/saml.py'sEdXSAMLIdentityProvider.get_attrand its test were independently reworked upstream in #37550 (social-auth-core unpinning) to handle the same social-core compatibility issue this PR's second commit also touched. Rather than reintroducing the older approach, this backport keepsmaster's existingget_attrimplementation as-is and carries forward only the new RelayState redirect logic, which applied cleanly on top of it.Testing
test_relaystate_splits_and_sets_next_when_safe,test_relaystate_drops_unsafe_next) are included.