Hi,
I have the following problem:
- My ARIS server is in the Intranet on server intranet.xyz.net . The loadbalancer is configured like this.
- I need to make ARIS Connect available to the Internet through a reverse proxy in the DMZ named internet.xyz.com using SAML using federation provider fed.xyz.com
- I configured https://fed.xyz.com/idp/SSO.saml2 as SSO Url and all other required SAML fields in UMC
- Now the user connects to internet.xyz.com which is given through to the ARIS server intranet.xyz.net (intransparent to the user).
- The ARIS Server does not know the user and starts the SAML process
- It redirects the user to https://internet.xyz.com/umc/rest/saml/initsso?tenant=default&url=https%3A%2F%2Finternet.xyz.com%2F
- This page is a html form containing the Base64 encoded SAML Request that is forwarded to https://fed.xyz.com/idp/SSO.saml2 using JavaScript directly after loading the page.
- The problem is: The SAML Request (if decoded or also visible in the umc logs) contains as AssertionConsumerServiceURL the value https://intranet.xyz.net/umc/rest/saml/initsso/ and not https://internet.xyz.com/umc/rest/saml/initsso/ so the user after being authenticated on https://fed.xyz.com/idp/SSO.saml2 is sent back to https://intranet.xyz.net/umc/rest/saml/initsso/ via browser and that address is not accessible by the user because it's in the Intranet
Is there a solution to the problem?