Note there is a related PR #451 , which tries to take care of all backend and frontend modules. I'd be happy if you could point out, if there are any key differences.

Thanks for the remark, I didn't noticed this PR. It seems we have now three different issues (#148, #179, #404), and two different PR (#451, #483) about the same problem :)

Regarding your own PR, it seems far more complete than mine, which was a quick'n'dirty fix for my own use case. I lack knowledge of SATOSA internals, but if I understand correctly, you modified routing to fix the issue. This strategies let persists inconsistencies between modules configurations, some using absolute URLs (SAML backend and frontends), ie:

endpoints:
assertion_consumer_service:
- [<base_url>/<name>/acs/post, 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST']

while others (idpy-oidc fronted) using relatives one, ie:

endpoint:
provider_info:
path: .well-known/openid-configuration


I'd personally prefer to enforce the same overall convention for configuration files. And I also feel easier to deduce absolute URLs by appending a relative one to base URL, when needed, than to try to deduce relative URLs from absolute ones, using complex parsing.

BTW, your PR doesn't cover the SAML2 backend, which has to be fixed as well, at least for the reload-metada endpoint, and probably for others too.