# Is RelayState essential for SAML Identity Brokering

**URL:** <https://forum.keycloak.org/t/is-relaystate-essential-for-saml-identity-brokering/8656>\
**Category:** Getting advice\
**Tags:** identity-brokering\
**Created:** [April 22, 2021, 9:58am UTC](https://forum.keycloak.org/t/is-relaystate-essential-for-saml-identity-brokering/8656 "2021-04-22T09:58:52Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![marcino](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@marcino](https://forum.keycloak.org/u/marcino)\
**Post date:** [April 26, 2021, 2:50pm UTC](https://forum.keycloak.org/t/is-relaystate-essential-for-saml-identity-brokering/8656/2 "2021-04-26T14:50:36Z")

</div>

It seems **YES**. Missing RelayState is enough to break the authentication on the broker.

It results in an error: [code, clientId or tabId was null - IDENTITY\_PROVIDER\_LOGIN\_ERROR](http://forum.keycloak.org/t/status-succes-from-saml-code-clientid-or-tabid-was-null-identity-provider-login-error/8594).

I have done verification with hand-crafted reverse proxy, that discarded RelayState (set it to blank string).

---

_[View the full topic](https://forum.keycloak.org/t/is-relaystate-essential-for-saml-identity-brokering/8656)._