Wrong redirect URI behind a proxy about active-directory-aspnetcore-webapp-openidconnect-v2

[jmprieur]

Thanks for the clear explanation, @Elanis

I'm not sure this is the right fix, but to make progress towards the issue resolution, I would try to insert a line here:

active-directory-aspnetcore-webapp-openidconnect-v2/Microsoft.Identity.Web/StartupHelpers.cs

Line 94 in 47f1fc5

var login = context.Properties.GetParameter<string>(OpenIdConnectParameterNames.LoginHint);

something like:

context.ProtocolMessage.RedirectUri = "https://example.com";

Please tell me if that worked.

[kalyankrishna1]

Could you advise the proxy admins to whitelist Azure AD endpoint "https://login.microsoftonline.com" and allow traffic to pass as is ?

[Elanis]

Hello, I don't think so. I don't have any control on the reverse proxy, and it isn't a .NET app.

Is there a way to force redirect_uri on the application side ?

Notes:

• What happening:
  

• The url i'm redirected to: https://login.microsoftonline.com/MYTENANTID/oauth2/v2.0/authorize?client_id=MYAPPLICATIONID&redirect_uri=http%3A%2F%2Fexample.com%2Fsignin-oidc&response_type=id_token&scope=openid%20profile&response_mode=form_post&nonce=NUMBERS.VERYLONGCHAIN&state=VERYLONGSTRING&x-client-SKU=ID_NETSTANDARD1_4&x-client-ver=5.2.0.0

Thanks for your help :)

[Elanis]

Yeah, thanks, It was fixed.

I got another error with Signature validation but I'll try to fix it by myself first. If I got another stuck or when I find out how to make it work, I'll update this issue to explain how to fix it (if another person have the problem).

[Elanis]

I already made it whitelisted because at first I couldn't couldn't call the AzureAD endpoint, but now, after being connected as my professional account, i got redirected to:
https://login.microsoftonline.com/......?redirect_uri=http://example.com........ instead of https://login.microsoftonline.com/......?redirect_uri=https://example.com.........

Isn't the library (or the web app itself) giving to the AzureAD endpoint the request URI ?

[jmprieur]

@Elanis : would this article help you? http://josephwoodward.co.uk/2016/07/proxying-http-requests-asp-net-core-using-kestrel ?

[Elanis]

Hello !

The problem fix was indeed:

Thanks for the clear explanation, @Elanis

I'm not sure this is the right fix, but to make progress towards the issue resolution, I would try to insert a line here:

active-directory-aspnetcore-webapp-openidconnect-v2/Microsoft.Identity.Web/StartupHelpers.cs

Line 94 in 47f1fc5

var login = context.Properties.GetParameter<string>(OpenIdConnectParameterNames.LoginHint);

something like:

context.ProtocolMessage.RedirectUri = "https://example.com";

Please tell me if that worked.

---

The problem I got after this fix was:

SecurityTokenInvalidSignatureException: IDX10503: Signature validation failed.

The fix was to add privileges to the service account running the website.

---

Thanks @jmprieur, you saved me some hours ! 😃

Problem Solved

[tylerforaie]

Hey @jmprieur or anyone else that may be monitoring this closed issue. I am encountering basically the same issue as above however now that Microsoft.Identity.Web is a nuget package things behave a little bit differently. The recommend practice is to use the .AddSignIn() extension and I am unable to see a way to set the redirect url as mentioned above. Any help would be appreciated.

I also made a stackoverflow post and would be receptive to any feedback there as well.

Thanks!

[jmprieur]

@tylerforaie : I think that this should be addressed by AzureAD/microsoft-identity-web#115, which is next on line to be implemented in Microsoft.identity.Web
cc: @jennyf19 as it's assigned to her.