Google SAML IDP initiated login does not work

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

saml

Describe the bug

I setup Google as an IDP in Keycloak. Signing in works fine.

However, IDP initiated signin does not work. That one is triggered by visiting https://workspace.google.com/dashboard and clicking on Keycloak.

The error reported by Keycloak is:

SAML RelayState parameter was null when it should be returned by the IDP

Google allows setting the RelayState to a static value. However RelayState in Keycloak is made of a state, tab and clientId.

Manually setting the Relay state to ..client_id gives the error:

error="expired_code", restart_after_timeout="true"

The RelayState is parsed here: https://github.com/keycloak/keycloak/blob/main/server-spi-private/src/main/java/org/keycloak/broker/provider/util/IdentityBrokerState.java#L72

I think allowing a static RelayState would solve this problem. There is no state when the login is IDP initiated.

Version

26.3.4

Regression

• The issue is a regression

Expected behavior

IDP-initiated signing works. Supporting a null RelayState seems the best option.

Actual behavior

An error occurs.

How to Reproduce?

1. Setup Google as an IDP via SAML
2. Go to https://workspace.google.com/dashboard and click on Keycloak

Anything else?

Related issues:

• https://github.com/keycloak/keycloak/issues/25349
• https://github.com/keycloak/keycloak/issues/12782

Related code:

• https://github.com/keycloak/keycloak/blob/746a8211ffd04fc4fb559ce2a05f800b38cd0eb6/services/src/main/java/org/keycloak/broker/saml/SAMLEndpoint.java#L531