PingFederate Engine uses Private Host instead of Public Host

[mattvalleycodes]

Describe the bug

I've followed the steps explained here and have a fully functional Ping cluster running on my local machine via Docker Desktop. I noticed that while Federate is only available via https://demo-pingfederate-admin.pingdemo.example, Ping Federate uses another base URL. Here are two examples:

Invalid host for /.well-known/openid-configuration

The [GET] https://demo-pingfederate-engine.pingdemo.example/.well-known/openid-configuration endpoint prefixes all of the endpoints with https://demo-pingfederate-engine:9031 instead of https://demo-pingfederate-engine.pingdemo.example.

Login form using the wrong base URL

The end-user gets redirected to a login page as part of the SSO process. I noticed the base URL in the HTML file is also wrong.

Federation Info Settings

A few online resources suggest changing the Base Url via the Federation info would fix the problem. I did change the value to the expected one and yet I'm getting invalid base URL

To Reproduce

1. Follow the instructions here and run a cluster using Docker Desktop
2. Open https://demo-pingfederate-engine.pingdemo.example/.well-known/openid-configuration in the browser or curl it using curl -k https://demo-pingfederate-engine.pingdemo.example/.well-known/openid-configuration

Expected behaviour

The .well-known/openid-configuration endpoint should use the public URLs as prefixes for all of the field values

[PingDavidR]

Thanks for the detailed write-up, @mattvalleycodes. We will take a look into this and keep you posted. At first glance, the use of private hosts is by design, but the team will investigate. Thanks!

[PingDavidR]

@mattvalleycodes I did some checking internally and got these as things to investigate as possible causes:

• Did not change the Base URL in the PingFederate deployment to actually match the external facing URL. In the deployment, the service in front of PF is on 443 (you can examine the services in Kubernetes) but the container running PF is on 9031. The service maps 443 to 9031.
• You also need to change the configuration for the base URL to reflect port 443 not 9031. In our server profiles referenced by the examples, they default to 9031.