Jenkins instances can be accessed through multiple URLs, not only the canonical one declared in Jenkins settings.

The redirection when doing the commenceLogin/finishLogin dance should occur on the domain that is being used to access the Jenkins instance.