Hi @amitvishwakarma we are using AEM as a Cloud Service where this property is not there. Please suggest what is the alternative we should follow for AEMaaCS.
Regards,
Som
Hi @som_adobe ,
AEMaaCS has stricter constraints than AMS or on-prem AEM (e.g., limited access to OSGi console, restricted SAML configs). So, here’s a Cloud-native workaround:
1. Use a Front-End Proxy or Dispatcher Rewrite (Preferred if possible)
If you control the entry point (e.g., a CDN like CloudFront, Azure Front Door, or Dispatcher), you can:
Encode the query params in a single RelayState-safe parameter (e.g., base64 or URL-encoded string).
Redirect to AEM with something like:
/content/mysite.html?relayState=base64(queryParams)
Then AEM just needs to preserve the relayState through SAML.
2. Custom Sling Filter to Capture Parameters and Redirect After Login:
Since OSGi checkbox options are not available in AEMaaCS, build a custom Sling Filter and a custom redirect servlet to simulate RelayState functionality:
Sling Filter (Runs Pre-authentication)
Stores the incoming full request URL (with query params) in a cookie or session attribute.
@Component(service = Filter.class,
property = {
Constants.SERVICE_RANKING + ":Integer=10000",
"sling.filter.scope=request"
})
public class SamlRelayStateFilter implements Filter {
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
HttpSession session = req.getSession();
if (req.getUserPrincipal() == null && req.getQueryString() != null) {
String fullUrl = req.getRequestURL().toString() + "?" + req.getQueryString();
session.setAttribute("customRelayState", fullUrl);
}
chain.doFilter(request, response);
}
}
Custom Redirect Servlet (Runs Post-authentication)
This servlet reads the stored URL and redirects the user after login
@Component(service = Servlet.class,
property = {
"sling.servlet.paths=/bin/custom/relayredirect",
"sling.servlet.methods=GET"
})
public class RelayRedirectServlet extends SlingAllMethodsServlet {
@Override
protected void doGet(SlingHttpServletRequest request, SlingHttpServletResponse response)
throws ServletException, IOException {
HttpSession session = request.getSession(false);
if (session != null) {
String relayUrl = (String) session.getAttribute("customRelayState");
if (relayUrl != null) {
session.removeAttribute("customRelayState");
response.sendRedirect(relayUrl);
return;
}
}
// Default fallback
response.sendRedirect("/content/mysite.html");
}
}
SAML Config Change
Set:
Default Redirect URL = /bin/custom/relayredirect
This will ensure the user is always returned to the original request after successful SAML login.
Note:
Use cookies instead of session if you need to support session-less environments (like microservices calling AEM).
Add encryption to stored URL (to avoid tampering).
Add logging to trace redirect flow for debugging.
.
