SES-42: Proxied requests for metadata do not reflect host header requested about spring-security-saml HOT 3 CLOSED

Rob Moore said:

I should have mentioned that I believe this will be an issue for non-proxied servers as well. Really any server that responds to requests for multiple hostnames will run into this issue.

from spring-security-saml.

GWA said:

I've made a patch (patch_entityid.patch) that resolve some part of this issue:

You can now add to the metadata filter a property (forcedEntityId) that will override URL found

For instance, if 'http://www.myserver.com/myapplication' id behind a reverse proxy, then the entity id (and base url) will be calculated based on the server inner address (say server-00005.inner.domain)
User cannot access directly to server-0005.inner.domain so no authentication is possible.
If you add the forcedEntityId,(see below) metadata will have a correct base url for the user.

This issue is also about virtual hosting ONE application. I believe this is a mistake.
To resolve this, you'd rather redirect each of your virtual host to the main host.

If your server has several application, each on a specific host, this patch will help you to resolve your issue

from spring-security-saml.

Vladimir Schäfer said:

You can set property entityBaseURL on thee metadataGenerator you pass to metadataFilter. This will override the baseURL which would be otherwise calculated based on the current request.

from spring-security-saml.