I'm experiencing an issue as described in this closed issue: https://github.com/casdoor/casdoor/issues/3582
I'm running a custom SAML IDP locally and using Casdoor as SP. In the issue, there is a reference to a working configuration in a demo application, but when logging into door.casdoor.com, the SAML provider config is empty and the custom SAML signin method doesn't work ("malformed certificate")
I am able to get around the 403 error, which happens in the cors_filter.go middleware, by either:
- Adding my SAML IDP URL to the redirect URIs of my Casdoor application
- Altering the cors filter to always set allowed origins for requests to
api/acs/, like it does for the userinfo endpoint for example
Which would be the correct approach?
