Seen the following behaviour with PL 2.5.3.Beta2 and 2.5.3.Final in EAP 6.3.0 builds.

When accessing a service provider (SP) using URL which does not point to the SP root, the redirects caused by IdP authentication lose part of the actual URL and only redirect back to the root of SP. This happens in the following scenario (realized e.g. by SAML2KerberosTestCase in the AS testsuite):

1) Access IdP directly and authenticate via Kerberos
2) Access SP using URL which retrieves a document in the SP context, e.g. /sp/printRoles

Actual behaviour:
- The SP root document, i.e. /sp/ is retrieved

Expected behaviour:
- Requested document, i.e. /sp/printRoles is retrieved.