Implement redirect path for SAML SSO

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/gid/gid.go

@@ -19,6 +19,8 @@ type (
 
 var (
 	Nil = GID{}
+
+	EncodedGIDSize = base64.RawURLEncoding.EncodedLen(GIDSize)
 )
 
 // ParseGID parses a string representation of a GID

pkg/iam/saml/service.go

@@ -153,11 +153,9 @@ func (s *Service) InitiateLogin(
 				return fmt.Errorf("cannot insert SAML request: %w", err)
 			}
 
-			relayState := url.Values{}
-			relayState.Add("config-id", config.ID.String())
-			relayState.Add("redirect-path", redirectPath)
+			relayState := config.ID.String() + redirectPath
 
-			redirect, err = req.Redirect(url.QueryEscape(relayState.Encode()), sp)
+			redirect, err = req.Redirect(relayState, sp)
 			if err != nil {
 				return fmt.Errorf("cannot generate redirect URL: %w", err)
 			}

pkg/server/api/connect/v1/saml_handler.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"net/url"
 
 	"github.com/go-chi/chi/v5"
 	"go.gearno.de/kit/httpserver"
@@ -59,13 +58,12 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
 	samlResponse := r.FormValue("SAMLResponse")
 	relayState := r.FormValue("RelayState")
 
-	values, err := url.ParseQuery(relayState)
-	if err != nil {
+	if len(relayState) < gid.EncodedGIDSize {
 		httpserver.RenderError(w, http.StatusBadRequest, errors.New("invalid relay state"))
 		return
 	}
 
-	configIDStr := values.Get("config-id")
+	configIDStr := relayState[:gid.EncodedGIDSize+1]
 	if configIDStr == "" {
 		httpserver.RenderError(w, http.StatusBadRequest, errors.New("missing config ID"))
 		return
@@ -77,7 +75,7 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	redirectPath := values.Get("redirect-path")
+	redirectPath := relayState[gid.EncodedGIDSize+1:]
 
 	user, membership, err := h.iam.SAMLService.HandleAssertion(ctx, samlResponse, configID)
 	if err != nil {