Modify the SSO URL to /login

saml/saml.go

@@ -232,9 +232,9 @@ func NewSAMLIDP(config *Config) (http.Handler, error) {
 	if err != nil {
 		return nil, err
 	}
-	ssoURL := baseURL
-	ssoURL.Path += "/sso"
-	metadataURL := baseURL
+	ssoURL := *baseURL
+	ssoURL.Path += "/login"
+	metadataURL := *baseURL
 	metadataURL.Path += "/metadata"
 	svc := fmt.Sprintf("%s%s", baseURL.Host, baseURL.Path)
 	if !strings.HasSuffix(svc, "/") {
@@ -246,11 +246,15 @@ func NewSAMLIDP(config *Config) (http.Handler, error) {
 		return nil, err
 	}
 
+	// Create the SAML IdentityProvider, but then we put another
+	// mux.Router in front in order to wrap just the ssoURL with
+	// our own SSO handler.
 	idp := &saml.IdentityProvider{
 		Key:                     cert.PrivateKey,
 		Certificate:             cert.Leaf,
 		Logger:                  logger.DefaultLogger,
-		SSOURL:                  *ssoURL,
+		MetadataURL:             metadataURL,
+		SSOURL:                  ssoURL,
 		ServiceProviderProvider: config,
 		SessionProvider:         users,
 	}