Salesforce SAML SSO: RelayState Parameter Returned as NULL from Identity Provider (IDP)

• Step 1: Verify RelayState in SAML Logs

  Verify the SAML request and response to confirm whether the RelayState parameter is NULL. You can use Fiddler logs or the SAML Tracer Firefox plugin to inspect the SAML traffic.
  In a correctly functioning SAML flow, the IDP request contains a RelayState value pointing to the originally requested resource. For example, a request sent to the IDP looks like this: the POST request includes a RelayState value such as /00O/0, which is the object key prefix for Salesforce Reports. After successful sign-on, the user is automatically redirected to the Reports tab in Salesforce.
  In the example above, the Salesforce org sends a POST request to the IDP with the RelayState value set to /00O/0. The IDP responds and Salesforce completes the SAML handshake. The user lands on the Reports tab because /00O/ is the Salesforce key prefix for the Reports object.
  Important: Salesforce uses an HTTP POST request during the SAML handshake. If your IDP URL is configured to use an HTTP GET request instead, the RelayState parameter is returned as NULL.
  Example Request sent to IDP:
  RequestBinding: HTTPPost
  PartnerId: https://demoorg.na2.force.com/login
  so: 00Dx0000000XXXX
  POST
  RelayState: /00O/0
  
  Example Response returned from IDP:
  GET
  so: 00Dx0000000YYYY
  POST
  RelayState: /00O/0
   

In the above example, "/00O/ is the object key prefix to reports. After successful sign on, user is automatically redirected to Reports tab in salesforce.

Note: Salesforce does a POST request, so check your IDP url that is provided by your IDP is not doing a GET request. Else, Relaystate param will be returned as NULL.
 

Step 2: Resolve the NULL RelayState

If the RelayState is returned as NULL, consider changing the Service Provider Initiated Request Binding from HTTP Post to HTTP Redirect in the Salesforce Single Sign-On settings, and update the Identity Provider login URL accordingly.
Example scenario: A user receives an email with a link to an Opportunity record. If the user is not logged in, clicking the link redirects them to the Salesforce or SSO login screen depending on the org's login settings. After successful SSO authentication, the user expects to land on the Opportunity record. However, if RelayState is NULL, the user is redirected to the Home page instead. Changing the Service Provider Binding to HTTP Redirect resolves this issue and ensures the user is redirected to the correct Opportunity record.

Developer Doc: Implementing Single Sign-On Across Multiple Organizations