SAML 2.0 RelayState Character Limit Exceeded in Salesforce OAuth Flow

When using OAuth with SAML 2.0 authentication, the RelayState value in a SAMLRequest may exceed 80 characters. According to the SAML 2.0 standard (section 3.4.3 of the OASIS SAML Bindings document), the RelayState value must not exceed 80 bytes in length.

However, Salesforce does not enforce this restriction for the following reason: when Salesforce acts as a Service Provider in an OAuth flow, it must include routing information in the RelayState to complete the OAuth authorization after the user is authenticated. This routing information can exceed 80 bytes.

Why Salesforce Exceeds the 80-Byte RelayState Limit

When a user authenticates via an OAuth User-Agent flow, the following sequence occurs:

1. Salesforce sends the user to the configured authentication service with a SAMLRequest.
2. The SAMLRequest includes a RelayState parameter containing a Salesforce return path (for example: /setup/secur/RemoteAccessAuthorizationPage.apexp?source=l86Hcy6qEKtWNqzXVErZDlmcRQs0D_HBE55MLVuP3x8t5wXkyH...). This value typically exceeds 80 bytes because it encodes the full OAuth state needed to resume the authorization flow.
3. The Identity Provider (IdP) authenticates the user and returns a SAMLResponse to Salesforce.
4. The Identity Provider must echo back the full RelayState value unchanged, even if it exceeds 80 bytes. Truncating or rejecting the RelayState will break the OAuth flow and prevent the user from completing authorization.

 outlined in section 3.4.3 of the Bindings for the OASIS Security Assertion Markup Language (SAML)​ document.