SAML 2.0 SSO集成中用户直接访问内容未触发认证的问题咨询及Deep Linking相关疑问

Hey there, let’s unpack your situation and those questions clearly:

First, to recap your scenario: As a service provider, you’ve exchanged valid SAML metadata with the IdP, but when their users click links to specific content on your platform, they’re being taken straight to the content without any SSO authentication/validation—like they had a direct bypass link. Your server logs show no SSO traffic hitting your ACS endpoint, and after over 30 emails and a month of back-and-forth, the IdP says the issue is:

The problem is caused by not having Deep Linking in the redirect link.

Now let’s tackle your questions:

1. What does that mean in the context of SSO integration? Do they mean redirecting using the RelayState? #

In SAML 2.0 SSO, "Deep Linking" almost always refers to preserving the specific content URL the user originally wanted to access throughout the SSO flow—and yes, this is typically handled via the RelayState parameter.

Here’s how the normal flow should work:

• User clicks a deep link (e.g., https://yourplatform.com/content/123)
• Your platform detects the user isn’t authenticated
• You redirect the user to the IdP’s SSO login endpoint, attaching the deep link URL as the RelayState parameter
• User completes authentication at the IdP
• The IdP redirects the user back to your ACS endpoint, sending both the valid SAML assertion and the original RelayState value
• Your platform validates the assertion, then redirects the user to the content URL in RelayState

That said, the IdP’s wording is a bit vague. It’s possible they’re referring to a specific configuration on their end—like requiring the deep link to be embedded in a custom parameter instead of standard RelayState, or expecting your SP to explicitly include the deep link in the SAML AuthnRequest. But in most standard SAML setups, RelayState is the standard way to handle deep linking.

2. How does this relate to users bypassing SSO entirely? #

Wait a second—your core problem right now is that users are skipping SSO to access content directly. That sounds less like a deep linking issue and more like a missing authentication check on your content pages. Let me break this down:

If users can access the content without hitting your ACS endpoint at all, that means your platform isn’t enforcing authentication for that content path. Even if deep linking was misconfigured, users should still be redirected to the IdP for authentication first—not straight to the content.

That said, the IdP’s comment might stem from a misunderstanding of your problem, or maybe their system expects a RelayState to be present to trigger the full SSO flow (though that’s non-standard). Here’s what you should check next:

• Verify your content page auth checks: Does every request to that content path first validate that the user has a valid SAML session? If not, that’s the primary issue—you need to add a check that redirects unauthenticated users to your SP’s SSO initiation endpoint, with the content URL as RelayState.
• Confirm your SSO initiation includes RelayState: When you redirect users to the IdP, are you correctly attaching the deep link as the RelayState parameter? Double-check the URL your platform generates for the IdP redirect.
• Push the IdP for clarity: Ask them to define exactly what they mean by "Deep Linking in the redirect link"—do they require a specific parameter, a format for the redirect URL, or something else entirely? Their vague answer isn’t enough to debug this.

备注：内容来源于stack exchange，提问作者Abdullah Esmail