Alternate AssertionConsumerServiceURL in SAML-Request

Please be aware of these limitations:

• The Atlassian Server or Data Center applications should always accessed using the configured base URL. Even if this is working in most cases, it is not supported (see https://confluence.atlassian.com/adminjiraserver/configuring-the-base-url-938847830.html or https://confluence.atlassian.com/doc/configuring-the-server-base-url-148592.html)

• In Atlassian Data Center environments, only the configured base URL will work

• The alternate URLs are not included in the Metadata, so they need to be added to the IdP manually

  • Please verify that your IdP supports this configuration. You may have to add the second SSO URLs to the Service Provider Setting on your IdP. Depending on your IdP the step is sometimes called “add multiple requestable SSO URLs” or “Allow this app to request other SSO URLs”, “multiple Reply-Urls”.

• Since the URL is derived from the host header, this may allow for a host header injection. Please see https://wiki.resolution.de/x/b4VMC

• There will also be potential Issues with URLs in E-Mail notifications for example.

• Also note that you may have to do other re-writes on your reverse proxy to make other Confluence / Jira functions work, that have nothing to do with our SAML Single Sign On Plugin as such. Unfortunately, we don’t know of a good guide that lists all of those