When the OAuth2/OIDC code determines whether to use a SSL connection or not is based on the http scheme of the incoming request. The problem with this is that the AM instance could be a part of a site where the external connection to the site is done over SSL but the request to the AM instance is over plain HTTP.
The site configuration should be taken into consideration when determining whether to use SSL or not.
- is duplicated by
-
OPENAM-3908 .well-known/openid-configuration should return endpoints as primary URL
-
- Resolved
-
- is related to
-
OPENAM-6219 Documentation of Base URL Provider Service
-
- Resolved
-
- is required by
-
-
- Resolved
-