search

vdenotaris / spring-boot-security-saml-sample

SBS3 — A sample SAML 2.0 Service Provider built on Spring Boot.
https://sbs3.vdenotaris.com
Apache License 2.0
562 stars 351 forks source link

Behind reverse proxy advertises localhost and internal port #82

Closed TamasSzerb closed 2 years ago

TamasSzerb commented 4 years ago

Describe the bug Behind reverse proxy, eg in cloud running it and can hit the main page, but when hitting https://<fqdn>/saml/metadata it tells:

<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://127.0.0.1:6817/saml/SingleLogout"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://127.0.0.1:6817/saml/SingleLogout"/>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</md:NameIDFormat>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://127.0.0.1:6817/saml/SSO" index="0" isDefault="true"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="http://127.0.0.1:6817/saml/SSO" index="1"/>

To Reproduce N/A

Expected behavior should use the incoming Host header/port via proxy.

Screenshots N/A

Desktop (please complete the following information): Linux, Java 11

Smartphone (please complete the following information): N/A

Additional context Add any other context about the problem here.

vdenotaris commented 2 years ago

See: https://docs.spring.io/spring-security-saml/docs/1.0.x/reference/html/configuration-advanced.html#configuration-load-balancing