* For production or when the IdP is configured with a different URL, you should
 * set one of the following:</p>
 *
 * <h3>Option 1: Set base URL (recommended for simplicity)</h3>
 * <pre>
 * # All SP URLs will be derived from this base URL
 * saml.sp.base.url=https://your-fess-server.example.com
 * </pre>
 *
 * <h3>Option 2: Set individual SP URLs</h3>
 * <pre>

                // This sends credentials in Base64 encoding over potentially unencrypted connections.
                // For production, it is STRONGLY RECOMMENDED to set spnego.allow.unsecure.basic to false
                // and use HTTPS or more secure authentication methods.
                return getProperty(SPNEGO_ALLOW_UNSECURE_BASIC, "true");
            }

        final String nonce = UuidUtil.create();
        storeStateInSession(request.getSession(), state, nonce);
        final String authUrl;

        if (useV2Endpoint) {
            // v2.0 endpoint with MSAL4J (recommended)
            authUrl = getAuthority() + getTenant()
                    + "/oauth2/v2.0/authorize?response_type=code&scope=https://graph.microsoft.com/.default&response_mode=form_post&redirect_uri="

                    httpAddress = "http://localhost:" + port; // Fallback
                }
                logger.warn("Embedded OpenSearch is running. This configuration is not recommended for production use.");
                break;
            }
        }
        client = createHttpClient(fessConfig, httpAddress);

        if (StringUtil.isNotBlank(httpAddress)) {