SAML and OAuth2/OIDC AC with relative callback URLs

[johakoch]

No description provided.

[johakoch]

We want to be able to use relative URL references as callback URIs for SAML SSO and OAuth2 Authorization Code Flow:

  saml "SSO" {
    sp_acs_url = "/saml/acs"
    ...
  }

and

  beta_oauth2 "google" {
    redirect_uri = "/oidc/cb"
    ...
  }

The relative URL references are resolved against the current request URL origin (use accept_forwarded_url setting or equivalent run option or env var to change the origin according to X-Fowarded-* request headers).

---

Note: This only works if the URLs of both the endpoint where the URL creating function (saml_sso_url() / beta_oauth_authorization_url()) is used and of the callback endpoint share the same origin. So the following will not work because the ports are not the same:

server "a" {
  hosts = [ "*:8080" ]
  endpoint "/oidc/start" {
    ... "...beta_oauth_authorization_url("oidc")..." # redirect_uri is http://localhost:8080/oidc/cb
    ...
  }
}
server "b" {
  hosts = [ "*:9000" ]
  endpoint "/oidc/cb" {
    access_control = [ "oidc" ] # redirect_uri is http://localhost:9000/oidc/cb
    ...
  }
}
definitions {
  beta_oauth2 "oidc" {
    redirect_uri = "/oidc/cb"
    ...
  }
}