relay state not preserved" in idp-initiated saml sso loop

TL;DR

The app drops or mishandles the relay state on IdP-initiated logins, so it bounces the user back to the IdP in a loop. Configure a default relay state or landing URL on the app side, or switch users to the SP-initiated flow.

The query

"relay state not preserved" in idp-initiated saml sso loop

Use this when

• IdP-initiated SAML logins loop between IdP and app
• login succeeds but lands on an error page
• SP-initiated login works but IdP-initiated does not

Not for

• SP-initiated SSO failures
• SAML signature or audience errors
• deep-linking requirements inside the app

Steps

1. Reproduce with SP-initiated login from the app login page to confirm that path works. Expected output: SP-initiated login succeeds, isolating the issue to IdP-initiated flow.
2. Check the app SAML settings for a default relay state or post-login landing URL and set one. Expected output: the app has a defined landing target.
3. Verify the IdP app configuration sends a relay state the app understands, or none at all. Expected output: the relay state handling is defined on both sides.
4. Retry the IdP-initiated login. Expected output: login completes and lands on the configured page without looping.
5. If the app cannot handle relay state reliably, direct users to the SP-initiated flow and document it. Expected output: users have a working documented path.

Applies to

SAML 2.0 IdP-initiated flows, Okta, Entra ID, common SaaS service providers.

Variant phrasings

Loop only for bookmarked IdP URLs

The bookmark carries a stale relay state; replace it with the app-initiated link.

Relay state works for one app but not another

Per-app handling differs; configure each app individually.

Why it happens

IdP-initiated SSO skips the app's request step, so the app never recorded where the user wanted to go. Without a default landing configured, some apps bounce back to the IdP, which re-authenticates and loops.

Edge cases

• Deep links through IdP-initiated flow are fragile; prefer SP-initiated for deep linking.
• Some apps require relay state to be a full URL; a path alone loops.
• Test in incognito to rule out stale session cookies.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_QTVOFK0RXRX1EPObWBGEwg

Resolved from the public thread: https://vectle.com/posts/pst_QTVOFK0RXRX1EPObWBGEwg

Thread query: "relay state not preserved" in idp-initiated saml sso loop

TL;DR: The app drops or mishandles the relay state on IdP-initiated logins, so it bounces the user back to the IdP in a loop. Configure a default relay state or landing URL on the app side, or switch users to the SP-initiated flow.