{"action":"created","issue":{"url":"https://api.github.com/repos/spinnaker/spinnaker/issues/996","repository_url":"https://api.github.com/repos/spinnaker/spinnaker","labels_url":"https://api.github.com/repos/spinnaker/spinnaker/issues/996/labels{/name}","comments_url":"https://api.github.com/repos/spinnaker/spinnaker/issues/996/comments","events_url":"https://api.github.com/repos/spinnaker/spinnaker/issues/996/events","html_url":"https://github.com/spinnaker/spinnaker/issues/996","id":166289214,"node_id":"MDU6SXNzdWUxNjYyODkyMTQ=","number":996,"title":"SAML Redirection cannot recognize subpath","user":{"login":"chongkong","id":4899492,"node_id":"MDQ6VXNlcjQ4OTk0OTI=","avatar_url":"https://avatars2.githubusercontent.com/u/4899492?v=4","gravatar_id":"","url":"https://api.github.com/users/chongkong","html_url":"https://github.com/chongkong","followers_url":"https://api.github.com/users/chongkong/followers","following_url":"https://api.github.com/users/chongkong/following{/other_user}","gists_url":"https://api.github.com/users/chongkong/gists{/gist_id}","starred_url":"https://api.github.com/users/chongkong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chongkong/subscriptions","organizations_url":"https://api.github.com/users/chongkong/orgs","repos_url":"https://api.github.com/users/chongkong/repos","events_url":"https://api.github.com/users/chongkong/events{/privacy}","received_events_url":"https://api.github.com/users/chongkong/received_events","type":"User","site_admin":false},"labels":[{"id":621997857,"node_id":"MDU6TGFiZWw2MjE5OTc4NTc=","url":"https://api.github.com/repos/spinnaker/spinnaker/labels/auth","name":"auth","color":"fef2c0","default":false},{"id":936546350,"node_id":"MDU6TGFiZWw5MzY1NDYzNTA=","url":"https://api.github.com/repos/spinnaker/spinnaker/labels/stale","name":"stale","color":"000000","default":false},{"id":1025177299,"node_id":"MDU6TGFiZWwxMDI1MTc3Mjk5","url":"https://api.github.com/repos/spinnaker/spinnaker/labels/to-be-closed","name":"to-be-closed","color":"000000","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-07-19T09:41:12Z","updated_at":"2018-10-12T22:04:42Z","closed_at":"2018-09-29T14:13:01Z","author_association":"NONE","body":"I'm using AWS Spinnaker AMI v42 instance, behind ELB for https. I've recently got into trouble when integrating ADFS SAML into Spinnaker.\n\nI've configured my Spinnaker to use only 9000 port with proper proxy option.\n\n``` yaml\nservices:\n  deck:\n    baseUrl: https://my.spinnaker.com\n    gateUrl: ${services.deck.baseUrl}/gate\n    bakeryUrl: ${services.deck.baseUrl}/rosco\n    auth:\n      enabled: true\n```\n\n``` apache\n<VirtualHost *:9000>\n  DocumentRoot /opt/deck/html\n  ProxyPreserveHost On\n\n  ProxyPass \"/gate\" \"http://localhost:8084\" retry=0\n  ProxyPassReverse \"/gate\" \"http://localhost:8084\"\n\n  ProxyPass \"/rosco\" \"http://localhost:8087\" retry=0\n  ProxyPassReverse \"/rosco\" \"http://localhost:8087\"\n\n  <Directory \"/opt/deck/html/\">\n    Require all granted\n  </Directory>\n</VirtualHost>\n```\n\nThe problem is, `/gate` subpath is unable to be recognized in actual application. (because it is proxied) After SAML authentication is succeeded, `SavedRequestAwareAuthenticationSuccessHandler` uses `savedRequest`, that was previously used, to resend the request with valid authentication. ([here](https://github.com/spring-projects/spring-security/blob/master/web/src/main/java/org/springframework/security/web/authentication/SavedRequestAwareAuthenticationSuccessHandler.java#L99)) But `savedRequest` cannot get `/gate` subpath, so request is saved without `/gate` subpath:\n\n| Original request | Saved request |\n| --- | --- |\n| `https://my.spinnaker.com/gate/auth/redirect?to=https%3A%2F%2Fmy.spinnaker.com%2F%23%2Finfrastructure` | `https://my.spinnaker.com/auth/redirect?to=https%3A%2F%2Fmy.spinnaker.com%2F%23%2Finfrastructure` |\n\nOf course, it shows an error page, although authentication itself is successful. So I have to enter address again to use Spinnaker.\n\nMy temporal solution is adding another line:\n\n``` apache\nProxyPass \"/auth/redirect\" \"http://localhost:8084/auth/redirect\n```\n"},"comment":{"url":"https://api.github.com/repos/spinnaker/spinnaker/issues/comments/429475554","html_url":"https://github.com/spinnaker/spinnaker/issues/996#issuecomment-429475554","issue_url":"https://api.github.com/repos/spinnaker/spinnaker/issues/996","id":429475554,"node_id":"MDEyOklzc3VlQ29tbWVudDQyOTQ3NTU1NA==","user":{"login":"eboumendil","id":6808600,"node_id":"MDQ6VXNlcjY4MDg2MDA=","avatar_url":"https://avatars3.githubusercontent.com/u/6808600?v=4","gravatar_id":"","url":"https://api.github.com/users/eboumendil","html_url":"https://github.com/eboumendil","followers_url":"https://api.github.com/users/eboumendil/followers","following_url":"https://api.github.com/users/eboumendil/following{/other_user}","gists_url":"https://api.github.com/users/eboumendil/gists{/gist_id}","starred_url":"https://api.github.com/users/eboumendil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eboumendil/subscriptions","organizations_url":"https://api.github.com/users/eboumendil/orgs","repos_url":"https://api.github.com/users/eboumendil/repos","events_url":"https://api.github.com/users/eboumendil/events{/privacy}","received_events_url":"https://api.github.com/users/eboumendil/received_events","type":"User","site_admin":false},"created_at":"2018-10-12T22:04:42Z","updated_at":"2018-10-12T22:04:42Z","author_association":"NONE","body":"It looks like this is still an active issue. The workaround works. I am using version 1.9.4. "}}
{"actor":{"display_login":"eboumendil"}}