# Google IDP initiated login is failing due to empty RelayState

**URL:** <https://forum.keycloak.org/t/google-idp-initiated-login-is-failing-due-to-empty-relaystate/14540>\
**Category:** Getting advice\
**Tags:** identity-brokering, saml\
**Created:** [March 24, 2022, 6:07am UTC](https://forum.keycloak.org/t/google-idp-initiated-login-is-failing-due-to-empty-relaystate/14540 "2022-03-24T06:07:28Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![suhail](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@suhail](https://forum.keycloak.org/u/suhail)\
**Post date:** [March 24, 2022, 6:07am UTC](https://forum.keycloak.org/t/google-idp-initiated-login-is-failing-due-to-empty-relaystate/14540/1 "2022-03-24T06:07:28Z")

</div>

We have Google SAML SSO login (IDP) in our Spring boot application (SP) with Keycloak as IDP broker. The SP initated login `(SpringApp -> keycloak -> GoogleSSO -> keycloak -> Spring)` works fine. However, if I login to my google account and click my saml application tile from the google app menu, the SSO fails at ACS endpoint with the below error.

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/7/7a8f056f247e0563804b3c6f3822ae6badae9a39.png)

Below error is logged inside keycloak server logs.

> ERROR [org.keycloak.services.resources.IdentityBrokerService] (default task-424) invalidRequestMessage
> 
> WARN [org.keycloak.events] (default task-424) type=IDENTITY\_PROVIDER\_LOGIN\_ERROR, realmId=\*\*\*\*-realm, clientId=null, userId=null, ipAddress=x.x.x.x, error=invalidRequestMessage

**Keycloak Identity Provider Configuration**

- Created new SAML v2.0 Identity provider from Identity providers menu.
- Redirect URI : _https://{keycloak-root}/auth/realms/{realm-name}/broker/{alias}/endpoint_
- First Login Flow: _first broker login_
- Service Provider Entity ID: _https://{keycloak-root}/auth/realms/{realm-name}_
- Single Sign-On Service URL: _{google idp sso url}_

**Keycloak Client Configuration:**

- Created a new keycloak client for sso.
- Client Protocol: _SAML_
- Signature Algorithm: _RSA\_SHA\_256_
- Name ID Format: _Username_
- Valid Redirect URIs: _{spring-boot-app-url} after successful authentication from google and keycloak_

**Google SAML App Configuration:**

- Entity ID: _https://{keycloak-root}/auth/realms/{realm-name}_
- ACS URL: _https://{keycloak-root}/auth/realms/{realm-name}/broker/{alias}/endpoint_

We compared the saml request of both SP and IDP login. In IDP login, on successful redirection from google to keycloak ACS url, we found the `RelayState` parameter is empty. But in SP login, same `RelayState` parameter has a string value present.

We could set a default value for `RelayState` using the `Start URL` field inside Google SAML app. But the problem is keycloak generates this value dynamically that changes on every login request.

Please suggest if any configuration changes has to be made to make idp initiated login work.