feat: Support IdP-initiated SAML auth with redirect destination in RelayState - #38938
Closed
jono-booth wants to merge 2 commits into
Closed
feat: Support IdP-initiated SAML auth with redirect destination in RelayState#38938jono-booth wants to merge 2 commits into
jono-booth wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds support for IdP-initiated SAML login flows to carry a post-auth redirect destination by encoding it into RelayState, extracting a safe next URL into the session, and rewriting RelayState back to the IdP slug so the existing SAML pipeline continues to function unchanged.
Changes:
- Parse
RelayStateas<idp_slug>|<next>and (when safe) storenextin the session duringSAMLAuthBackend.auth_complete. - Always rewrite
RelayStateback to just the IdP slug before continuing the SAML auth flow. - Add unit tests covering safe vs. unsafe
nexthandling inRelayState.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| common/djangoapps/third_party_auth/saml.py | Adds RelayState parsing/validation and session next handling for IdP-initiated SAML completes. |
| common/djangoapps/third_party_auth/tests/test_saml.py | Adds tests validating RelayState splitting, safe redirect persistence, and unsafe redirect dropping. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+133
to
+157
| slug_part, next_part = str(relay_state).split('|', 1) | ||
| slug_part = slug_part.strip() | ||
| next_part = next_part.strip() | ||
| if not slug_part or not next_part: | ||
| return | ||
|
|
||
| # URL-decode next (Auth0 or callers may URL-encode it). | ||
| next_decoded = unquote(next_part) | ||
|
|
||
| # Only store next if it's safe per existing Open edX redirect policy. | ||
| if is_safe_login_or_logout_redirect( | ||
| redirect_to=next_decoded, | ||
| request_host=request.get_host(), | ||
| dot_client_id=(request.GET.get('client_id') if hasattr(request, 'GET') else None), | ||
| require_https=request.is_secure(), | ||
| ): | ||
| request.session['next'] = next_decoded | ||
| else: | ||
| # RelayState included an unsafe destination; clear any stale 'next' value | ||
| request.session.pop('next', None) | ||
|
|
||
| # Always rewrite RelayState to just the IdP slug so the SAML backend can locate the provider. | ||
| post_copy = request.POST.copy() | ||
| post_copy['RelayState'] = slug_part | ||
| request._post = post_copy # pylint: disable=protected-access |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Backport of edx#108, originally merged to our
release-ulmorelease branch.Adds support for IdP-initiated SAML login flows (where the user doesn't first hit
/auth/login/...) to carry a post-auth redirect destination. Since some IdPs (e.g. Auth0) can only reliably influence the SAML POST viaRelayState,RelayStatemay now encode both the IdP slug and anextdestination as"<idp_slug>|<next>".SAMLAuthBackend.auth_completeextracts and validatesnext(via the existingis_safe_login_or_logout_redirectsafety check) before rewritingRelayStateback down to just the slug so the rest of the SAML pipeline continues to work unmodified.Backport notes
masterhas diverged from where this was originally written (Feb 2026):common/djangoapps/third_party_auth/saml.py'sEdXSAMLIdentityProvider.get_attrand its test were independently reworked upstream in #37550 (social-auth-core unpinning) to handle the same social-core compatibility issue this PR's second commit also touched. Rather than reintroducing the older approach, this backport keepsmaster's existingget_attrimplementation as-is and carries forward only the new RelayState redirect logic, which applied cleanly on top of it.Testing
test_relaystate_splits_and_sets_next_when_safe,test_relaystate_drops_unsafe_next) are included.