Empty RelayState when using authentik as SP

[elythh]

Hello,

I have a question regarding ADFS federation using Authentik as the Service Provider (SP). We have successfully set it up and it's operational. However, we are encountering a redirection issue. When attempting to access an application protected by Authentik and logging in through an external Identity Provider (IdP), we are redirected back to the Authentik applications page.

Upon further investigation, we observed that the RelayState, along with all the query parameters from our initial request, are lost between the authentication's Identification stage and the federation's Pre-authentication flow.

So, my questions are:

1. Why is the Pre-authentication flow necessary when establishing a federation? Since the default one is empty and we have no plans to use it, I'm uncertain why this flow is mandatory.

2. Is there a specific reason behind the query parameters suddenly becoming empty when reaching the federation's Pre-authentication stage?

Some additional infos :

• we're using Post auto binding
• this is the network trace