SAML SSO behind https load balancer redirects back to http after authentication with id provider

[icelava]

Debug mode

• I have enabled debug mode
• I have read checked the Common Issues page

Describe the bug

When we first tested out self-hosting Snipe-IT on local web server then on local Docker and Kubernetes, our SAML setup with Microsoft Entra Enterprise application worked fine when operating on plain http.

Now that we're moving to the next stage of an actual real-world production setup

• AWS EKS
  • nodes behind https ALB; target group forward to pod port 80
• APP_URL=https://snipe-it.domain.net
• APP_FORCE_TLS=true
  • Since for some reason instead of returning relative paths for resources it returns absolute path with http (Snipe-IT behind reverse proxy loads resources using HTTP instead of HTTPS #9179)
  • Also needed to be defined as envrionment variable since it ignores the one in .env (like Kubernetes pod ignores APP_KEY in .env #15384)

Pre-flight setup, uploading and restoring backup file seemed to work fine. And the browser reload after restoration expectedly redirects to Microsoft. But on redirect back to Snipe-IT site, it times out. Turns out it was redirecting back to http://snipe-it.domain.net instead of https.

Not sure why it does this when APP_FORCE_TLS already true.

Reproduction steps

1. SAML SSO with Entra ID Enterprise application already set up and working with previous site.
2. Add new https URLs of target migration site to enterprise application. (Works for test http sites.)
3. Add certificate of new site to ALB with listener rule for that host name to target group to Snipe-IT nodes.
4. Wire up Kubernetes resources TargetGroupBinding -> Nodeport service -> Deployment/pod
5. Access site to go through pre-flight setup.
6. Upload backup file; restore file.
7. Reload restored site and redirect and authenticate with Microsoft 365.
8. Get redirected back to (non-existent) http site.
   ...

Expected behavior

Redirected back to Snipe-IT on https.

Screenshots

No response

Snipe-IT Version

v7.0.11 build 15044 (g46ed07642)

Operating System

Ubuntu

Web Server

Apache

PHP Version

8.1.2-1ubuntu2.18

Operating System

Windows 111 23H2

Browser

Firefox

Version

129.0.2

Device

No response

Operating System

No response

Browser

No response

Version

No response

Error messages

No error messages per se. Only a single log entry.

root@snipe-it-595687695-hh5zn:/var/www/html/storage/logs# cat laravel.log
[2024-09-05 16:32:19] production.WARNING: Attempting to restore user: administrator@domain.net

Additional context

No response

[icelava]

Extra note that after we migrated our production data to a permanent infrastructure (of the same setup), I did not experience the redirect to http:// but my collleague did and he had to refresh multiple times before it'll redirect properly to https://

Don't know what's behind the inconsistent behaviour.

[stmichaelis]

Had the exact same problem with a simple Podman, Caddy as Proxy and Keycloak for SSO setup. Version 7.0.12 from yesterday seems to have fixed this. Hope it is not a race condition that reappears.