Dynamically Set SAML SSO Callback URL Based on User Organization

This article addresses whether it is possible to set the Security Assertion Markup Language (SAML) callback URL dynamically during the login flow.

The user attempts to use the following code to set the callback URL in a Post-Login Action:

exports.onExecutePostLogin = async (user, context) => {
  if (user.organization.name === 'Org_A') {
    context.samlConfiguration.callback = 'https://destination_A.com';
  } else {
  // Default redirect URL if no specific organization match
    context.samlConfiguration.callback = 'https://destination_B.com';
  }
};

When this configuration is applied, the following error message is displayed:

Error: access_denied, cannot set properties of undefined (setting callback)

• SAML2 Add-on

• Login Flow

It is not possible to dynamically change where the SAML response is posted from an Action. The system always posts the SAML response to the configured Application Callback URL, regardless of how the destination is configured.

To achieve this, configure a separate application with its own SAML2 add-on configuration. Subsequently, make a second login request to each application conditionally based on the organization ID in the user's ID token.