diff -ur sso.old/client/singlesignon_client.module sso/client/singlesignon_client.module
--- sso.old/client/singlesignon_client.module	2009-09-30 11:56:47.000000000 -0700
+++ sso/client/singlesignon_client.module	2009-11-03 16:09:43.000000000 -0800
@@ -79,9 +79,9 @@
         }
         else {
           // Return to the original request origin.
-          $goto = $_GET['origin'];
-          if ($_GET['singlesignon_message']) {
-            $goto .= (strpos($goto, '?') !== FALSE ? '&' : '?') . 'singlesignon_message=' . urlencode($_GET['singlesignon_message']);
+          $goto = url($_GET['destination'], array('absolute' => TRUE));
+          if (!empty($_GET['singlesignon_message'])) {
+            $goto .= (strpos($goto, '?') === FALSE ? '?' : '&') .'singlesignon_message='. urlencode($_GET['singlesignon_message']);
           }
           singlesignon_goto($goto);
         }
@@ -103,8 +103,10 @@
 
       // Set up a request id and try to associate with the controller.
       $_SESSION['request_id'] = singlesignon_get_random_id();
+      $request_path = explode(base_path(), rtrim(request_uri(), '?'), 2);
       $request_data = array(
-          'origin' => $base_url . request_uri(),
+          'origin' => $base_url,
+          'destination' => $request_path[1],
           'request_id' => $_SESSION['request_id'],
           );
       if ($_GET['singlesignon_message']) {
@@ -192,13 +194,14 @@
     parse_str($data['query'], $query);
     unset($query['singlesignon_message']);
     $query = singlesignon_build_query($query);
-    $origin = $base_url . '?' . $query;
+    $request_path = explode(base_path(), rtrim(request_uri(), '?'), 2);
 
     $form['#action'] = singlesignon_create_request(
         $controller,
         $action,
         array(
-          'origin' => $origin,
+          'origin' => $base_url,
+          'destination' => $request_path[1],
         ),
         $key
       );
@@ -229,7 +232,7 @@
   // Prevent looping if controller and client are running on one installation
   // (in case of Domain Access modules and others).
   $client = (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['SERVER_NAME'];
-  if (variable_get('singlesignon_client_controller_url', '') == $client) {
+  if (variable_get('singlesignon_client_controller_url', '') == $base_url) {
     // Can't use t() here - it doesn't exist yet. small TODO
     drupal_set_message('Only one single sign-on module can be installed at a time. Please disable single sign-on client or controller on this site.', 'error');
     return TRUE;
diff -ur sso.old/controller/singlesignon_controller.module sso/controller/singlesignon_controller.module
--- sso.old/controller/singlesignon_controller.module	2009-09-30 11:56:47.000000000 -0700
+++ sso/controller/singlesignon_controller.module	2009-11-03 21:18:25.000000000 -0800
@@ -71,12 +71,13 @@
   $key = singlesignon_controller_get_private_key();
 
   // Verify request integrity.
-  if (!singlesignon_verify_request($key) || !isset($_GET['origin'])) {
+  if (!singlesignon_verify_request($key) || !isset($_GET['destination'])) {
     return;
   }
   else {
     // Redirect to given origin.
-    $form_state['redirect'] = $_GET['origin'];
+    $form_state['redirect'] = url($_GET['destination'], array('absolute' => TRUE, 'base_url' => $_GET['origin']));
+    unset($_REQUEST['destination']);
   }
 }
 
@@ -137,14 +138,10 @@
   // Make sure the global session is being saved.
   $_COOKIE[session_name()] = TRUE;
 
-  // Prepare root base URL for the given origin site.
-  $parsed = parse_url($_GET['origin']);
-  $client_url = $parsed['scheme'] .'://'. $parsed['host'];
-
   // Return URL to claim the newly set up session using the assigned nonce.
   $request_data = array(
       'nonce' => $nonce,
-      'origin' => $_GET['origin'],
+      'destination' => $_GET['destination'],
       'request_id' => $_GET['request_id'],
       );
   if ($_GET['singlesignon_message']) {
@@ -152,7 +149,7 @@
   }
 
   singlesignon_goto(singlesignon_create_request(
-    $client_url,
+    $_GET['origin'],
     'singlesignon/claim',
     $request_data,
     $key
diff -ur sso.old/singlesignon.inc sso/singlesignon.inc
--- sso.old/singlesignon.inc	2009-09-30 11:55:11.000000000 -0700
+++ sso/singlesignon.inc	2009-11-03 21:20:15.000000000 -0800
@@ -119,20 +119,18 @@
  * query arguments (including the page path), as if clean URLs were off.
  */
 function singlesignon_create_request($base_url, $path, $arguments, $key) {
-
   // Generate HMAC from arguments.
   if ($_SESSION['singlesignon_message']) {
     $arguments['singlesignon_message'] = $_SESSION['singlesignon_message'];
   }
   $hmac = singlesignon_hmac($base_url, array('q' => $path) + $arguments, $key);
 
-
   // Cannot use drupal_query_string_encode(). Drupal 6 applies mod_rewrite
   // workaround on query arguments unnecessarily.
   $query = singlesignon_build_query($arguments);
 
   // Compose regular Drupal URL.
-  $url = $base_url . url($path, array('query' => $query));
+  $url = url($path, array('absolute' => TRUE, 'base_url' => $base_url, 'query' => $query));
 
   // Append HMAC to GET URL.
   return $url . (strpos($url, '?') !== FALSE ? '&' : '?') .'auth='. $hmac;