There is nothing worse than a SOLVED question with no public solution. So here's the likely solution: When sending RelayState back to the sP (Splunk), it must be changed to the base64 form of something like return_to=/en-US/&username=USERNAME&accepted_tos=1 and sent along with the base64 encoded SAMLResponse from the idP. ... View more