When the RelayState is set in saml20-sp-hosted.php and the external idp initiates an idp-first sign in without providing a RelayState the user should end up at the RelayState given in the metadata file. Instead they end up at [host]/sp/saml2/sp/

I believe this is caused by a change that happened after version 1.11.0 and is down to this line in 1.12.0/www/saml2/sp/AssertionConsumerService.php

$info['RelayState'] = SimpleSAML_Utilities::checkURLAllowed($response->getRelayState());

In version 1.11.0 this was as below which would return null and force the RelayState to be as in the metadata file but in version 1.12.0 it actually populates the RelayState with a duff url.

$info['RelayState'] = $response->getRelayState();