Explicitly specifying a default port (e.g. http://example.com:80 or
https://example.com:443) will cause Mellon to fail. This occurs
because the port gets embedded into the location URL for each endpoint
in the SP metadata (e.g the Assertion Consumer Service). The IdP sets
the Destination attribute in the SAML response by looking it up in the
SP metadata, thus the Destination will have the default port in it
(e.g. 443). Upon receiving the SAML response the SP compares the URL
of the request to the Destination attribute in the SAML response, they
must match for the response to be considered valid. However when
Mellon asks Apache what the request URL was it won't have the port in
it thus the URL comparison fails causing the server to return a 503
Bad Request error. So why is the port absent? It turns out that most
(all?) browsers will strip the port from a URL if it matches the port
for the scheme (e.g. 80 for http and 443 for https). Thus even if you
include the port in the URL it will never be included in the URL the
browser emits. This also includes stripping the port from the HTTP
host header (which Apache uses to reconstruct the URL).

The fix is to have keycloak-httpd-client-install recognize when a
default port has been specified and remove it from the mellon host
URL so it does not get embedded into any of the SAML endpoints.