[v15] feat: adds relay_state to SAMLIdPServiceProviderSpecV1

api/proto/teleport/legacy/types/types.proto

@@ -5959,6 +5959,10 @@ message SAMLIdPServiceProviderSpecV1 {
   // Preset is used to define service provider profile that will have a custom behavior
   // processed by Teleport.
   string Preset = 5 [(gogoproto.jsontag) = "preset"];
+  // RelayState is used to add custom value in the SAML response as a relay_state HTTP parameter.
+  // The value can contain service provider specific redirect URL, static state token etc.
+  // The value is only applied in the IdP initiated SSO flow.
+  string RelayState = 6 [(gogoproto.jsontag) = "relay_state"];
 }
 
 // SAMLAttributeMapping represents SAML service provider requested attribute

api/types/saml_idp_service_provider.go

@@ -133,6 +133,10 @@ type SAMLIdPServiceProvider interface {
 	GetAttributeMapping() []*SAMLAttributeMapping
 	// SetAttributeMapping sets Attribute Mapping.
 	SetAttributeMapping([]*SAMLAttributeMapping)
+	// GetRelayState returns Relay State.
+	GetRelayState() string
+	// SetRelayState sets Relay State.
+	SetRelayState(string)
 	// Copy returns a copy of this saml idp service provider object.
 	Copy() SAMLIdPServiceProvider
 	// CloneResource returns a copy of the SAMLIdPServiceProvider as a ResourceWithLabels
@@ -195,6 +199,16 @@ func (s *SAMLIdPServiceProviderV1) SetAttributeMapping(attrMaps []*SAMLAttribute
 	s.Spec.AttributeMapping = attrMaps
 }
 
+// GetRelayState returns Relay State.
+func (s *SAMLIdPServiceProviderV1) GetRelayState() string {
+	return s.Spec.RelayState
+}
+
+// SetRelayState sets Relay State.
+func (s *SAMLIdPServiceProviderV1) SetRelayState(relayState string) {
+	s.Spec.RelayState = relayState
+}
+
 // String returns the SAML IdP service provider string representation.
 func (s *SAMLIdPServiceProviderV1) String() string {
 	return fmt.Sprintf("SAMLIdPServiceProviderV1(Name=%v)",
@@ -265,13 +279,29 @@ func (s *SAMLIdPServiceProviderV1) CheckAndSetDefaults() error {
 		attrNames[attributeMap.Name] = struct{}{}
 	}
 
-	if ok := validatePreset(s.Spec.Preset); !ok {
+	if ok := s.checkAndSetPresetDefaults(s.Spec.Preset); !ok {
 		return trace.Wrap(ErrUnsupportedPresetName)
 	}
 
 	return nil
 }
 
+// validatePreset validates SAMLIdPServiceProviderV1 preset field.
+// preset can be either empty or one of the supported type.
+func (s *SAMLIdPServiceProviderV1) checkAndSetPresetDefaults(preset string) bool {
+	switch preset {
+	case "":
+		return true
+	case samlsp.GCPWorkforce:
+		if s.GetRelayState() == "" {
+			s.SetRelayState(samlsp.DefaultRelayStateGCPWorkforce)
+		}
+		return true
+	default:
+		return false
+	}
+}
+
 // SAMLIdPServiceProviders is a list of SAML IdP service provider resources.
 type SAMLIdPServiceProviders []SAMLIdPServiceProvider
 
@@ -316,14 +346,3 @@ func (am *SAMLAttributeMapping) CheckAndSetDefaults() error {
 	}
 	return nil
 }
-
-// validatePreset validates SAMLIdPServiceProviderV1 preset field.
-// preset can be either empty or one of the supported type.
-func validatePreset(preset string) bool {
-	switch preset {
-	case "", samlsp.GCPWorkforce:
-		return true
-	default:
-		return false
-	}
-}

api/types/saml_idp_service_provider_test.go

@@ -27,14 +27,16 @@ import (
 // TestNewSAMLIdPServiceProvider ensures a valid SAML IdP service provider.
 func TestNewSAMLIdPServiceProvider(t *testing.T) {
 	tests := []struct {
-		name             string
-		entityDescriptor string
-		entityID         string
-		acsURL           string
-		errAssertion     require.ErrorAssertionFunc
-		expectedEntityID string
-		attributeMapping []*SAMLAttributeMapping
-		preset           string
+		name               string
+		entityDescriptor   string
+		entityID           string
+		acsURL             string
+		errAssertion       require.ErrorAssertionFunc
+		expectedEntityID   string
+		attributeMapping   []*SAMLAttributeMapping
+		preset             string
+		relayState         string
+		expectedRelayState string
 	}{
 		{
 			name:             "valid entity descriptor",
@@ -194,6 +196,31 @@ func TestNewSAMLIdPServiceProvider(t *testing.T) {
 			},
 			preset: "notsupported",
 		},
+		{
+			name:               "GCP Workforce user provided relay state",
+			entityID:           "IAMShowcase",
+			acsURL:             "https:/test.com/acs",
+			errAssertion:       require.NoError,
+			preset:             samlsp.GCPWorkforce,
+			relayState:         "user_provided_relay_state",
+			expectedRelayState: "user_provided_relay_state",
+		},
+		{
+			name:               "GCP Workforce default relay state",
+			entityID:           "IAMShowcase",
+			acsURL:             "https:/test.com/acs",
+			errAssertion:       require.NoError,
+			preset:             samlsp.GCPWorkforce,
+			expectedRelayState: samlsp.DefaultRelayStateGCPWorkforce,
+		},
+		{
+			name:               "default relay state should not be set for empty preset value",
+			entityID:           "IAMShowcase",
+			acsURL:             "https:/test.com/acs",
+			errAssertion:       require.NoError,
+			preset:             "",
+			expectedRelayState: "",
+		},
 	}
 
 	for _, test := range tests {
@@ -206,14 +233,23 @@ func TestNewSAMLIdPServiceProvider(t *testing.T) {
 				ACSURL:           test.acsURL,
 				AttributeMapping: test.attributeMapping,
 				Preset:           test.preset,
+				RelayState:       test.relayState,
 			})
 
 			test.errAssertion(t, err)
 			if sp != nil {
-				require.Equal(t, test.expectedEntityID, sp.GetEntityID())
+				if test.expectedEntityID != "" {
+					require.Equal(t, test.expectedEntityID, sp.GetEntityID())
+				}
 				if len(sp.GetAttributeMapping()) > 0 {
 					require.Equal(t, test.attributeMapping, sp.GetAttributeMapping())
 				}
+				if test.preset == "" && test.relayState == "" {
+					require.Empty(t, sp.GetRelayState())
+				}
+				if test.expectedRelayState != "" {
+					require.Equal(t, test.expectedRelayState, sp.GetRelayState())
+				}
 			}
 		})
 	}

api/types/samlsp/samlsp.go

@@ -21,3 +21,8 @@ const (
 	// Workforce Identity Federation.
 	GCPWorkforce = "gcp-workforce"
 )
+
+const (
+	// DefaultRelayStateGCPWorkforce is a default relay state for GCPWorkforce preset.
+	DefaultRelayStateGCPWorkforce = "https://console.cloud.google/"
+)