Community SSO Social Login — RelayState/StartURL Not Propagated (Custom Aura Login Component)

This article explains why users authenticating via Single Sign-On (SSO) on a Salesforce Experience Cloud community built with a custom Aura login component are redirected to the community root page instead of their intended destination page after successful authentication. SSO is an authentication method that allows users to log in once and gain access to multiple connected systems without logging in again for each one.
The root cause is that the Aura framework does not propagate the startURL (the intended destination page URL the user was trying to reach before being redirected to log in) through the SAML authentication flow to the social login component.

What Is the Issue?

When a custom Aura-based login form triggers the SSO flow using the SAML authentication request endpoint for the community, the startURL (the community page path the user intended to reach) is not carried through to the SAML AuthnRequest. As a result, the RelayState parameter — which is used by SAML to carry the intended destination URL back through the authentication handshake — is sent as a forward slash ("/"), representing the site root, instead of the actual community page path.
After the Identity Provider (IdP) authenticates the user and redirects them back to Salesforce, the user lands on the default community root page instead of the page they originally requested.

Key Terms

• SSO (Single Sign-On): An authentication method that allows a user to log in once to an Identity Provider and access multiple connected systems, including Salesforce Experience Cloud, without re-entering credentials.
• IdP (Identity Provider): The external system that authenticates the user. Examples include Microsoft Entra ID (formerly Azure Active Directory) and Okta.
• SAML (Security Assertion Markup Language): An open standard for exchanging authentication and authorization data between an Identity Provider and a Service Provider (Salesforce acts as the Service Provider in this scenario).
• AuthnRequest: The SAML authentication request that Salesforce sends to the IdP when a user initiates SSO login.
• RelayState: A SAML parameter that carries the intended destination URL through the authentication flow so the user is redirected to the correct page after login.
• startURL: The community page URL the user was attempting to access before being redirected to the login page.
• Aura: Salesforce's older component framework used to build Experience Cloud pages and components. The Aura framework does not propagate the startURL to the social login component.
• LWC (Lightning Web Component): Salesforce's modern component framework. The LWC login component correctly handles startURL propagation through all SSO navigation flows.
• Experience Cloud: Salesforce's platform for building branded digital experiences, portals, and communities for customers and partners.

Real-World Scenario

A customer clicks a link to a specific community page, such as a knowledge article at the community path for a specific topic. Salesforce detects the user is not authenticated and redirects them to the community login page, storing the intended destination as the startURL. The custom Aura login component triggers the SAML SSO flow. Because the Aura social login component does not receive the startURL from the Aura login form, RelayState is set to "/" in the AuthnRequest. The IdP authenticates the user and redirects them back to Salesforce. Salesforce reads the RelayState value of "/" and redirects the user to the community root page instead of the original article page. The user must manually navigate back to the page they intended to visit.

Why Does This Happen?

This behavior occurs because the social login component in the Aura framework depends on the login form to supply the startURL. The Aura framework does not pass this value through correctly. The LWC framework received an enhancement to handle this propagation correctly, so migrating the login component to LWC resolves the issue.