Problem
The redirect URI is currently generated based on the hostname configured in the module settings.
This causes issues when users access Icinga using a different hostname than the configured FQDN. For example:
In this scenario, the SSO flow fails even if the redirect URI is correctly configured in the identity provider (e.g. Azure Entra ID / Azure AD), because the generated redirect request always uses the configured FQDN instead of the hostname that was actually used by the client.
The same problem occurs when Icinga is accessed through alternative DNS names or aliases.
Expected Behavior
The module should generate the redirect URI based on the hostname of the current incoming request (for example using the request's host header), rather than always using the statically configured FQDN.
This would allow SSO to work correctly regardless of whether users access Icinga via:
- The primary FQDN
- A short hostname
- Alternative DNS aliases
Current Behavior
The redirect URI always contains the configured FQDN, even when the user accessed the application through a different hostname.
Affected Code
application/controllers/OidcController.php (around line 40)
Suggested Improvement
Use the hostname from the current request when building the redirect URI, or provide a configuration option that allows choosing between:
- Static hostname (current behavior)
- Dynamically detected hostname from the incoming request
This would improve compatibility with environments where multiple DNS names are used to access the same Icinga instance.
Problem
The redirect URI is currently generated based on the hostname configured in the module settings.
This causes issues when users access Icinga using a different hostname than the configured FQDN. For example:
In this scenario, the SSO flow fails even if the redirect URI is correctly configured in the identity provider (e.g. Azure Entra ID / Azure AD), because the generated redirect request always uses the configured FQDN instead of the hostname that was actually used by the client.
The same problem occurs when Icinga is accessed through alternative DNS names or aliases.
Expected Behavior
The module should generate the redirect URI based on the hostname of the current incoming request (for example using the request's host header), rather than always using the statically configured FQDN.
This would allow SSO to work correctly regardless of whether users access Icinga via:
Current Behavior
The redirect URI always contains the configured FQDN, even when the user accessed the application through a different hostname.
Affected Code
application/controllers/OidcController.php (around line 40)
Suggested Improvement
Use the hostname from the current request when building the redirect URI, or provide a configuration option that allows choosing between:
This would improve compatibility with environments where multiple DNS names are used to access the same Icinga instance.