BaseSAMLMessageDecoder.checkEndpointURI

[Zmuda, Matthew R]

The following is called to get the actual endpoint:

StringBuffer urlBuilder = httpRequest.getRequestURL();

Doc's say:

StringBuffer getRequestURL()
Reconstructs the URL the client used to make the request. The returned URL contains a protocol, server name, port number, and server path, but it does not include query string parameters.


At this point in time client is at the new URI.
So why would it be the server configuration's obligation to report the logical URI when the code is getting the client's URI?

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, March 01, 2012 1:39 PM
To: Shib Users
Subject: RE: BaseSAMLMessageDecoder.checkEndpointURI

> The Authentication Request is sent to use at one URI that is intercepted and
> changed for load balancing.

It is your web server configuration's obligation to report the logical URI, not the physical one. Anything else will break any properly written application that needs to issue redirects to itself. It's not  a SAML issue, just basic correctness when virtualizing.
 
-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure prohibited. If received in error, please go to www.td.com/legal for instructions.
AVIS : Message confidentiel dont le contenu peut être privilégié. Utilisation/divulgation interdites sans permission. Si reçu par erreur, prière d'aller au www.td.com/francais/avis_juridique pour des instructions.