Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow default redirect URI for Azure #55

Open
Michael-A-McMahon opened this issue Jan 23, 2024 · 0 comments
Open

Allow default redirect URI for Azure #55

Michael-A-McMahon opened this issue Jan 23, 2024 · 0 comments
Assignees

Comments

@Michael-A-McMahon
Copy link
Member

Currently, Azure providers require a redirect URI to be configured. They will raise an exception if the URI is not configured.

For most users (maybe all users?) explicitly configuring a URI with a particular port number is not necessary. If an App Registration in Azure has ANY localhost URI registered as a redirect URI, then a client can use ANY localhost URI with ANY port number. In other words: The port number doesn't need to match with one configured in Azure.

This behavior seems to be documented here: https://learn.microsoft.com/en-us/entra/identity-platform/reply-url#localhost-exceptions

Due to ephemeral port ranges often required by native applications, the port component (for example, :5001 or :443) is ignored for the purposes of matching a redirect URI. As a result, all of these URIs are considered equivalent:

http://localhost/MyApp
http://localhost:1234/MyApp
http://localhost:5000/MyApp
http://localhost:8080/MyApp

The fix for this issue is no longer require that a redirect URI is configured. If the URI is not configured, then the HTTP server used for interactive authentication binds to any available port number in the ephemeral range.
The choice of port number is actually implemented by the Azure SDK for Java. It seems it may choose a port in the range of (8400,9000). This is an implementation detail outside of the provider code base.
The only change in the provider code base will revolve around the redirectUri call of the InteractiveBrowserCredentialBuilder class. Either this method will not be called, or it is called with http://localhost, a URI without a port number. Need to investigate and test this.

@Michael-A-McMahon Michael-A-McMahon self-assigned this Jan 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant