Understanding Redirect Uri in Azure App Registration

Redirect Uri in Azure App Registration is a crucial concept to grasp, especially when dealing with authentication flows. It's essentially a URL that the Azure AD will redirect the user to after authentication.

The Redirect Uri is used to specify where the Azure AD will send the user after authorization. In Azure App Registration, it's a required field when configuring the authentication settings.

A common mistake is to use a URL that's not properly formatted, which can lead to authentication errors. Make sure to use the correct format, including the protocol (http or https) and the path to the redirect Uri.

In Azure App Registration, the Redirect Uri is typically set to a specific URL on your application's server. This URL should match the one specified in the client configuration.

Readers also liked: Azure Web App Nginx Login Authentication

A redirect URI, also known as a reply URL, is the location where the Microsoft Entra authentication server sends the user once they have successfully authorized and been granted an access token.

To sign in a user, your application must send a login request with a redirect URI specified as a parameter. This is crucial for successful authentication.

In a production web application, the redirect URI is often a public endpoint where your app is running, like https://contoso.com/auth-response. This is where the authentication server will redirect the user and issue an access token.

During development, it's common to also add the endpoint where you run your app locally, like https://127.0.0.1/auth-response or http://localhost/auth-response. This allows for testing and debugging.

Be sure to remove any unnecessary development environments/redirect URIs from the production app to maintain security. This can be done by having separate app registrations for development and production.

Check this out: Azure Auth Json Website Azure Ad Authentication

You need to add redirect URIs to your app registration for security reasons. The authentication server won't redirect users or send tokens to a URI that isn't added to the app registration.

Consider reading: Azure App Registration vs Enterprise Application

Adding a redirect URI is a must if your application uses specific authorization protocols. These protocols include OAuth 2.0 authorization code flow, OAuth 2.0 client credentials flow, OAuth 2.0 implicit grant flow, OpenID Connect, and Single sign-on SAML protocol.

You can check if your application uses one of these protocols by looking at the authorization flow you're implementing. If it does, you'll need to add the corresponding redirect URIs to your app registration.

Here's a list of authorization protocols that require redirect URIs in app registration:

On the other hand, if your application uses Native Authentication, OAuth 2.0 device code flow, OAuth 2.0 On-Behalf-Of flow, OAuth 2.0 Resource owner password credential flow, Windows Integrated Auth Flow, or SAML 2.0 Identity Provider (IdP) for Single Sign On, you don't need to add redirect URIs to your app registration.

To add a redirect URI, you need to configure the platform settings for your registered application. You can add and modify redirect URIs to specify the location where the Microsoft identity platform redirects a user's client and sends security tokens after authentication.

For your interest: Redirect Traffic from Aws to Azure

You must add a redirect URI to your app registration if your application is using OAuth 2.0 authorization code flow, OAuth 2.0 client credentials flow, OAuth 2.0 implicit grant flow, OpenID Connect, or Single sign-on SAML protocol.

The redirect URI must begin with the scheme https, with exceptions for some localhost redirect URIs. This is a security requirement to ensure that the authentication server only redirects users and sends tokens to a trusted location.

You can add multiple redirect URIs, but they must be case-sensitive and match the case of the URL path of your running application. This means that if your application is running at https://example.com, you should add the redirect URI as https://example.com, not https://Example.com.

Here are the authorization protocols that require adding a redirect URI:

The Microsoft Entra application model also specifies some restrictions on redirect URIs, including:

These restrictions are in place to ensure the security and reliability of the authentication process.

To add a redirect URI to your Azure app registration, you need to consider the authorization protocol your application uses. If your application is using OAuth 2.0 authorization code flow, OAuth 2.0 client credentials flow, OAuth 2.0 implicit grant flow, OpenID Connect, or Single sign-on SAML protocol, you must add appropriate redirect URIs to your app registration.

You can add a redirect URI by configuring the platform settings for your application in the Azure portal. To do this, go to App registrations, select your application, and under Manage, select Authentication. Then, under Platform configurations, select Add a platform and choose the tile for your application type.

For mobile and desktop applications, you should use the Mobile and desktop applications platform to add a redirect URI. This applies to iOS and macOS apps, Android apps, and apps that run natively on a mobile device or desktop machine.

There are restrictions on the format of redirect URIs. They must begin with the scheme https, with exceptions for some localhost redirect URIs. Redirect URIs are case-sensitive and must match the case of the URL path of your running application.

Curious to learn more? Check out: Azure Devops Desktop App

To avoid security implications, it's recommended to use absolute URIs instead of wildcard URIs. Wildcard URIs like https://*.contoso.com may seem convenient, but they can strip query strings and fragments in the redirect URI. If your scenario requires more redirect URIs than the maximum limit allowed, consider using the state parameter approach instead of adding a wildcard redirect URI.

Here's a summary of the types of applications that require redirect URIs:

If you're experiencing issues with Cluster Oauth login using Azure AD (OpenID Connect), check if the Redirect URIs in Azure AD match the OpenShift OAuth URI.

The AADSTS50011 error can occur if the Redirect URIs in Azure AD do not match the OpenShift OAuth URI.

To resolve the issue, get the application ID in Azure AD from the error message.

You can update the Redirect URIs in Azure AD by going to the Microsoft_AAD_RegisteredApps Authentication page and updating them to match the OpenShift OAuth URI.

Here's an interesting read: Azure Active Directory App Registration

Verify the Redirect URIs in Azure AD again after making the update to ensure they match the expected OpenShift OAuth URI.

Here's a quick summary of the steps to resolve the issue:

To add a redirect URI to your app registration, you must do so for security reasons, as the authentication server won't redirect users or send tokens to a URI that isn't added.

You should add a redirect URI to your app registration if your application uses OAuth 2.0 authorization code flow, OAuth 2.0 client credentials flow, OAuth 2.0 implicit grant flow, OpenID Connect, or Single sign-on SAML protocol.

If your application uses Native Authentication, OAuth 2.0 device code flow, OAuth 2.0 On-Behalf-Of flow, OAuth 2.0 Resource owner password credential flow, or Windows Integrated Auth Flow, you don't need to add redirect URIs to your app registration.

To configure a redirect URI, you need to follow these steps: In the Azure portal, in App registrations, select your application, then under Manage, select Authentication, and under Platform configurations, select Add a platform.

A unique perspective: Wordpress Azure App Service Linux Login Authentication

For web applications, you should select the Web platform, enter a Redirect URI for your app, and select Configure to complete the platform configuration. The Redirect URI is the location where the Microsoft identity platform redirects a user's client and sends security tokens after authentication.

Here are the platforms where you can add a redirect URI based on your application type:

For iOS apps using open source SDKs (AppAuth), cross-plat tech we don't support (Flutter), or implementing our OAuth protocols directly, use the Mobile and desktop applications platform to add a redirect URI.