RE: [saml-dev] IdP initiated SSO and RelayState

["Cantor, Scott" <cantor.2@osu.edu>]

> Try not to use IdP initiated SSO: the "normal" relay state provides
> an effective means against replay attacks (as using the same relay state
> a second time is automatically detected and will fail). If the IdP
> (rather than the SP) can provide the relay state, replay attacks
> must be prevented in another (much more complicated) way.

No. Replay detection is based on the assertion ID or artifact. RelayState can be freely manipulated by the client, so it's not suitable for that.

-- Scott