diff --git a/openstack_auth/utils.py b/openstack_auth/utils.py
index d8610104..358f7725 100644
--- a/openstack_auth/utils.py
+++ b/openstack_auth/utils.py
@@ -183,6 +183,15 @@ def is_websso_enabled():
     return websso_enabled and keystonev3_plus
 
 
+def build_absolute_uri(request, relative_url):
+    """Ensure absolute_uri are relative to WEBROOT."""
+    webroot = getattr(settings, 'WEBROOT', '')
+    if webroot.endswith("/") and relative_url.startswith("/"):
+        webroot = webroot[:-1]
+
+    return request.build_absolute_uri(webroot + relative_url)
+
+
 def has_in_url_path(url, sub):
     """Test if the `sub` string is in the `url` path."""
     scheme, netloc, path, query, fragment = urlparse.urlsplit(url)
diff --git a/openstack_auth/views.py b/openstack_auth/views.py
index 8d5a0f59..68a1b082 100644
--- a/openstack_auth/views.py
+++ b/openstack_auth/views.py
@@ -60,7 +60,7 @@ def login(request, template_name=None, extra_context=None, **kwargs):
         protocol = request.POST.get('auth_type', 'credentials')
         if utils.is_websso_enabled() and protocol != 'credentials':
             region = request.POST.get('region')
-            origin = request.build_absolute_uri('/auth/websso/')
+            origin = utils.build_absolute_uri(request, '/auth/websso/')
             url = ('%s/auth/OS-FEDERATION/websso/%s?origin=%s' %
                    (region, protocol, origin))
             return shortcuts.redirect(url)