SAML login error: unable to validate response URL

Description:

When doing a SAML login we have the following error in the log and the user is redirected back to the Rocketchat home page (the page with the 'login with saml' button:

error Error: Unable to validate response url at app/meteor-accounts-saml/server/lib/SAML.ts:386:12 at ResponseParser.validate (app/meteor-accounts-saml/server/lib/parsers/Response.ts:51:11) at SAMLServiceProvider.validateResponse (app/meteor-accounts-saml/server/lib/ServiceProvider.ts:188:17) at Function.processValidateAction (app/meteor-accounts-saml/server/lib/SAML.ts:382:19) at Function.processRequest (app/meteor-accounts-saml/server/...

Investigations:

We noticed that the reponse URL contains the internal port of RocketChat (3000). This seems like a regression.
The authentication passes if we expose RocketChat on the port 3000 (which is not doable in prod since it's on 443).

This is a blocker issue for us.

Server Setup Information:

• Version of Rocket.Chat Server: 3.14.0
• Operating System: Linux
• Deployment Method: Helm
• Number of Running Instances: 1
• DB Replicaset Oplog: enabled
• NodeJS Version: v12.22.1
• MongoDB Version: 4.0.3 / wiredTiger (oplog Enabled)

Client Setup Information

• Desktop App or Browser Version: Chrome
• Operating System: Windows

Start with app/meteor-accounts-saml/server/lib/SAML.ts at line 386, then inspect Response.ts and ServiceProvider.ts where the response URL is validated. Reproduce the SAML login through the Helm deployment and compare the URL containing port 3000 with the external HTTPS URL; done means authentication succeeds when Rocket.Chat is exposed on port 443.