The issue seems to be that when UAA is running on a standard port :80 or :443 and that port is included in the metadata. The destination within the SAML response includes the port, but the location from the relying party registration does not. Therefore the comparison does not match and authentication fails.

Agreed that the default port stripping is probably at the root of this.

The purpose behind this change is to expose both of the elements being compared in the conditional so that it is clearer why this particular error is returned by UAA.

Having only half of the information in the error message makes it impossible to understand the root cause when this error occurs.