BaseSAMLMessageDecoder.checkEndpointURI

[Cantor, Scott]

> The Authentication Request is sent to use at one URI that is intercepted and
> changed for load balancing.

It is your web server configuration's obligation to report the logical URI, not the physical one. Anything else will break any properly written application that needs to issue redirects to itself. It's not  a SAML issue, just basic correctness when virtualizing.
 
-- Scott