From 89306d7dbc96d0c7dfe2c6025cefc2d72e4f224e Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 19 May 2026 05:26:18 +0000 Subject: [PATCH] fix: honor SAML RelayState to redirect to deep link after SSO login (#9225) * fix: honor SAML RelayState to redirect to deep link after SSO login Co-Authored-By: Claude Opus 4.7 (1M context) * chore: bump ee-repo-ref for SAML RelayState validator test Co-Authored-By: Claude Opus 4.7 (1M context) * chore: update ee-repo-ref to a3fefe85f5f2f52bb473fa47acc9efa8fd0b2206 This commit updates the EE repository reference after PR #577 was merged in windmill-ee-private. Previous ee-repo-ref: 445a22536b1a6c342cde0baa6fbca9e25092f94b New ee-repo-ref: a3fefe85f5f2f52bb473fa47acc9efa8fd0b2206 Automated by sync-ee-ref workflow. --------- Co-authored-by: Claude Opus 4.7 (1M context) Co-authored-by: windmill-internal-app[bot] --- backend/ee-repo-ref.txt | 2 +- frontend/src/lib/components/Login.svelte | 16 +++++++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt index 919919c4c6..7eec3ee9fe 100644 --- a/backend/ee-repo-ref.txt +++ b/backend/ee-repo-ref.txt @@ -1 +1 @@ -19a76a09ffb43649ee19e62d07e8b8a42d78757b +a3fefe85f5f2f52bb473fa47acc9efa8fd0b2206 diff --git a/frontend/src/lib/components/Login.svelte b/frontend/src/lib/components/Login.svelte index 98afb8c5a2..dce840814e 100644 --- a/frontend/src/lib/components/Login.svelte +++ b/frontend/src/lib/components/Login.svelte @@ -415,7 +415,21 @@ return false } persistRd() - window.location.href = saml + let target = saml + // Carry the SP-initiated deep link through the IdP round-trip via SAML + // RelayState so the ACS redirects straight back to it (bypassing + // /user/login). Only same-origin relative paths are passed; the backend + // re-validates. Absolute `rd` still relies on the localStorage fallback. + if (rd && rd.startsWith('/') && !rd.startsWith('//')) { + try { + const url = new URL(saml) + url.searchParams.set('RelayState', rd) + target = url.toString() + } catch (e) { + console.error('Could not set SAML RelayState', e) + } + } + window.location.href = target return true }