From 16556f9fb91fb5240598abef6c3dac004da6119b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Wed, 11 Feb 2026 19:28:33 +0400
Subject: [PATCH] Implement redirect path for SAML SSO
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 pkg/gid/gid.go                            | 2 ++
 pkg/iam/saml/service.go                   | 6 ++----
 pkg/server/api/connect/v1/saml_handler.go | 8 +++-----
 3 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/pkg/gid/gid.go b/pkg/gid/gid.go
index 45583ed10..0fd3ecdf6 100644
--- a/pkg/gid/gid.go
+++ b/pkg/gid/gid.go
@@ -19,6 +19,8 @@ type (
 
 var (
 	Nil = GID{}
+
+	EncodedGIDSize = base64.RawURLEncoding.EncodedLen(GIDSize)
 )
 
 // ParseGID parses a string representation of a GID
diff --git a/pkg/iam/saml/service.go b/pkg/iam/saml/service.go
index 1cacca038..f76765d20 100644
--- a/pkg/iam/saml/service.go
+++ b/pkg/iam/saml/service.go
@@ -153,11 +153,9 @@ func (s *Service) InitiateLogin(
 				return fmt.Errorf("cannot insert SAML request: %w", err)
 			}
 
-			relayState := url.Values{}
-			relayState.Add("config-id", config.ID.String())
-			relayState.Add("redirect-path", redirectPath)
+			relayState := config.ID.String() + redirectPath
 
-			redirect, err = req.Redirect(url.QueryEscape(relayState.Encode()), sp)
+			redirect, err = req.Redirect(relayState, sp)
 			if err != nil {
 				return fmt.Errorf("cannot generate redirect URL: %w", err)
 			}
diff --git a/pkg/server/api/connect/v1/saml_handler.go b/pkg/server/api/connect/v1/saml_handler.go
index b789f88be..32ac3cf27 100644
--- a/pkg/server/api/connect/v1/saml_handler.go
+++ b/pkg/server/api/connect/v1/saml_handler.go
@@ -4,7 +4,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"net/url"
 
 	"github.com/go-chi/chi/v5"
 	"go.gearno.de/kit/httpserver"
@@ -59,13 +58,12 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
 	samlResponse := r.FormValue("SAMLResponse")
 	relayState := r.FormValue("RelayState")
 
-	values, err := url.ParseQuery(relayState)
-	if err != nil {
+	if len(relayState) < gid.EncodedGIDSize {
 		httpserver.RenderError(w, http.StatusBadRequest, errors.New("invalid relay state"))
 		return
 	}
 
-	configIDStr := values.Get("config-id")
+	configIDStr := relayState[:gid.EncodedGIDSize+1]
 	if configIDStr == "" {
 		httpserver.RenderError(w, http.StatusBadRequest, errors.New("missing config ID"))
 		return
@@ -77,7 +75,7 @@ func (h *SAMLHandler) ConsumeHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	redirectPath := values.Get("redirect-path")
+	redirectPath := relayState[gid.EncodedGIDSize+1:]
 
 	user, membership, err := h.iam.SAMLService.HandleAssertion(ctx, samlResponse, configID)
 	if err != nil {