I'm trying to use AWS Cognito with a user pool using Azure AD as an Identity Provider (OpenID Connect).
I set up the User Pool in Cognito and specify the callback URL of my test app (https://localhost:44381) and I configure an App Registration in Azure AD that has the same URL in the Redirect URIs.
In the AWS Console, under App Client Settings, I click "Launch Hosted UI" to test it. It displays a page that lets me choose my configured Identity Provider (Azure AD). On that page, I can see in the URL what it has for "&redirect_uri=". It has https://mydomain.auth.us-east-2.amazaoncognito.com/oauth2/.
So I put that URL in both AWS Cognito and in Azure AD as the Callback URI/Redirect URI.
Then when I click through to the Identity Provider, it pops up the normal Azure AD login and lets me log in, but I get:
AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application: '60e47fff-e2cc-41d8-8405-283bafb33fbb'.
This is the application (client) ID from Azure AD.
Likewise, when I run this from my test app, I can see the redirect_uri=https://localhost:44381/oidc in the URL - but same thing happens - redirect mismatch. Though that exact URL is in both AWS and Azure AD.
How can I find out what it is trying to "match"? It's obviously changing something in the URL that I give it.
Related
I’m workin in a project with React JS that needs authenticate user from a redirect using a url with the “login_hint” param. There is a federation in AD and a Cognito User Pool with SAML configuration referenced to that federation domain. I can authenticate user normally with oAuth configuration and use Amplify Hub for listening data, but a I can’t found a solution to solve the authentication by redirect.
Example:
User login on Site A using federated AD account;
User click in a link to access the Site B, under same federation
URL to site B in site A href attribute is “https://www.siteb.net/?login_hint=user#domain.com
Site B reads URL and get “login_hint” value to request the user token or session to AD
Finally, the Amplify sends silent authentication to Cognito
So, it’s possible using Amplify, or combination of the Amplify and MSAL… or that is not possible this way?
The azure app service provided an URL in such format https://your-app-name.azurewebsites.net
When Expose an API in azure app registration the Application ID URI is needed. But when I use the url provided by the azure app service I got the following error:
Values of identifierUris property must use a verified domain of
the organisation or its subdomain: https://your-app-name.azurewebsites.net
the URL provided by the app service is not a verified domain? and how can I make it verified?
Application ID URI is an identifier that can be used instead of the client ID when specifying a scope defined in that app.
It has nothing to do with authentication redirect URIs, where it would need to match your app hosting.
Agree with juunas and this is just additional description. Screenshot below contained the error you met and one of the supported App ID URI pattern.
I'm afraid that the reason for exposing API is that you want to protect your web API with Azure AD. The App ID URI here is used for the authorization. Your web app also requires to configure the audience, then after you integrate Azure AD authorization into your application, the scope, the audience and other claims containing in the incoming access token will all be verified. I have a sample which is based on a web api. You can see the configuration for Azure AD authorization.
And https://your-app-name.azurewebsites.net is for authentication which used for redirect from microsoft identity platform back to your own web app. The scenario can be opening your own web page which requiring user to sign in --> redirect to microsoft sign in page --> sign in then redirect back to your web page. So we need to identify the redirect URL in Azure AD.
I am using Keycloak 12.0.1 as an identity broker and Azure AD as an identity provider using SAML2.0. I get below error when trying to do IDP initiated SSO -
SP initiated sign-on works fine. The error message is not descriptive enough to find the root cause. I've not setup any client in Keycloak, I want this to work just like SP initiated sign-on in which after successful login, Keycloak profile page is displayed.
Below are links to the metadata -
Service Provider Metadata
SAML Response by Azure AD
Update:
I forgot to mention that Keycloak expects relay-state in IDP initiated sso response (without which Keycloak shows NullPointerException on the server console) but I'm not sure what value I should provide for relay-state here because I've not setup any custom clients. I want Azure AD to redirect to the default client that Keycloak provides (i.e account-console).
I grabbed relay-state from SP initiated sign-on and used the same value for IDP initiated one and the NullPointerException goes away but I get 'InvalidRequesMessage'. So I'm suspecting it has to do with the relay-state value I'm using.
I'm trying to integrate Azure AD B2C with my App Service using the Authentication / Authorization menu in the portal (also called EasyAuth).
This is what I did:
Registered the application in Azure B2C
Recorded the App ID
Defined user flows (just Sign In)
Set up identity provider (Azure AD)
Tested the user flow, with Redirect URI pointing to jwt.ms, to see the result - works fine
Enabled Authentication / Authorization in the App Service in the Portal
Configured Azure AD authentication with the App ID from above and the link to the endpoint metadata
But now, when I access the App Service, I'm redirected to a "Logging in..." page which immediately goes to the jwt.ms page, with no JWT data, no login page, and no opportunity to enter my credentials.
Just an empty jwt page.
I couldn't find anything in the docs that can explain this.
What am I missing?
Sign-in with Microsoft identity provider fails, works with others
I have an Azure AD B2C tenant with a SingIn and SignUp policy that I hope to use
for user management with an Angular2 SPA.
The policy is configured for three identity providers:
Google
Microsoft
Email Signup
When I use the Run Now button in the Azure portal to run this policy, I get the default Sign In dialog, and I can sign in with either Google or Email signin. (By that I mean I get re-directed to my app's redirect page as I expect.) However, when I try to sign in using the Microsoft
provider, I end up at an error page with the following address:
https://login.live.com/err.srf?lc=1033#error=invalid_request&error_description=The+provided+value+for+the+input+parameter+'redirect_uri'+is+not+valid.+The+expected+value+is+'https://login.live.com/oauth20_desktop.srf'+or+a+URL+which+matches+the+redirect+URI+registered+for+this+client+application.&state=StateProperties%3deyJTSUQiOiJ4LW1zLWNwaW0tcmM6NDcyMmQyNjItOTk1Yi00YTJlLWFmNWUtODkwNDgyODlhMzM0IiwiVElEIjoiM2Y2ZDVmNjAtMDdiNC00ZDA3LWEyZDItN2U3YWQwOWRhOGQ5In0
I see that the problem is related to an invalid redirect_uri. But I thought the redirect_uri was an application-level setting shared by ALL identity provders that I have configured. Why does my redirect_uri setting work for Google and Email signup, but not for Microsoft?
You have to configure your Microsoft application with the right redirect URL.
As stated in the documentation:
Enter https://login.microsoftonline.com/te/{tenant}/oauth2/authresp in the Redirect URIs field. Replace {tenant} with your tenant's name (for example, contosob2c.onmicrosoft.com).
Why you have to do this: (courtesy of Chris Padgett)
The redirect URI that is configured in the Azure AD B2C Portal represents the reply address for your client application. This is so Azure AD B2C can return an ID token to your client application. The redirect URI that is configured in the Application Registration Portal represents the reply address for your Azure AD B2C tenant. This is so the Microsoft Account identity provider can return a security token to your Azure AD B2C tenant.
So, your app is federating authentication to Azure AD B2C.
B2C then further federates to the Microsoft Account identity provider.
So when a user a logs in with a Microsoft account, they are sent back to B2C with a token, which B2C validates.
If all is okay, they are signed in to B2C, and sent back to your app.
So you see that from the point of view of the MSA identity provider, B2C is the client.
So the redirect URL there must point to B2C.
As the document stated, you should Enter https://login.microsoftonline.com/te/{tenant}/oauth2/authresp in the Redirect URIs field.
But I thought the redirect_uri was an application-level setting shared
by ALL identity provders that I have configured. Why does my
redirect_uri setting work for Google and Email signup, but not for
Microsoft?
You're right, the redirect_uri is an applicaiton-level sttings. It should be same in all IDPs redirect URIs. But this Redirec URI is set by Azure. NOT your applicaiton. It means that your can use other IDPs to login to your app with AAD B2C, NOT login to your applicaiton directly. So, the redirect_uris must be https://login.microsoftonline.com/te/{tenant}/oauth2/authresp, not the redirect_uri in your application itself.
URI doesn't equal URL. The redirect URI is just a unique identifier to which Azure AD will redirect the user-agent in an OAuth 2.0 request. It's not redirect URL, Azure AD authentication endpoint https://login.microsoftonline.com/ use redirect URIs to check where it should be responsed. Aslo, it can be same as the URL as the endpoint. Here should be the same I guess.
Summary, you need use the unique redirect URI https://login.microsoftonline.com/te/{tenant}/oauth2/authrespfor all IDPs , not just Microsoft account.
Hope this helps!