RedirectCallbackHander uses HttpServletRequest.getRequestURL to construct AM_REDIRECT_BACK_SERVER_URL

RedirectCallbackHandler

public void handleRedirectCallback(HttpServletRequest request, HttpServletResponse response,
RedirectCallback redirectCallback, String loginURL) throws IOException {

if (debug.messageEnabled())

{ debug.message("Redirect to external web site..."); debug.message("RedirectUrl : " + redirectCallback.getRedirectUrl() + ", RedirectMethod : " + redirectCallback.getMethod() + ", RedirectData : " + redirectCallback.getRedirectData()); }

String qString = AuthUtils.getQueryStrFromParameters(redirectCallback.getRedirectData());

String requestURL = request.getRequestURL().toString();
String requestURI = request.getRequestURI();
int index = requestURL.indexOf(requestURI);

HttpServletRequest.getRequestURL returns protocol://hostname of the server hosting the servlet and not what's displayed on browser. So if OpenAM server is behind reverse proxy, it will return wrong URL.