You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, Azure providers require a redirect URI to be configured. They will raise an exception if the URI is not configured.
For most users (maybe all users?) explicitly configuring a URI with a particular port number is not necessary. If an App Registration in Azure has ANY localhost URI registered as a redirect URI, then a client can use ANY localhost URI with ANY port number. In other words: The port number doesn't need to match with one configured in Azure.
Due to ephemeral port ranges often required by native applications, the port component (for example, :5001 or :443) is ignored for the purposes of matching a redirect URI. As a result, all of these URIs are considered equivalent:
The fix for this issue is no longer require that a redirect URI is configured. If the URI is not configured, then the HTTP server used for interactive authentication binds to any available port number in the ephemeral range.
The choice of port number is actually implemented by the Azure SDK for Java. It seems it may choose a port in the range of (8400,9000). This is an implementation detail outside of the provider code base.
The only change in the provider code base will revolve around the redirectUri call of the InteractiveBrowserCredentialBuilder class. Either this method will not be called, or it is called with http://localhost, a URI without a port number. Need to investigate and test this.
The text was updated successfully, but these errors were encountered:
Currently, Azure providers require a redirect URI to be configured. They will raise an exception if the URI is not configured.
For most users (maybe all users?) explicitly configuring a URI with a particular port number is not necessary. If an App Registration in Azure has ANY localhost URI registered as a redirect URI, then a client can use ANY localhost URI with ANY port number. In other words: The port number doesn't need to match with one configured in Azure.
This behavior seems to be documented here: https://learn.microsoft.com/en-us/entra/identity-platform/reply-url#localhost-exceptions
The fix for this issue is no longer require that a redirect URI is configured. If the URI is not configured, then the HTTP server used for interactive authentication binds to any available port number in the ephemeral range.
The choice of port number is actually implemented by the Azure SDK for Java. It seems it may choose a port in the range of (8400,9000). This is an implementation detail outside of the provider code base.
The only change in the provider code base will revolve around the
redirectUri
call of theInteractiveBrowserCredentialBuilder
class. Either this method will not be called, or it is called withhttp://localhost
, a URI without a port number. Need to investigate and test this.The text was updated successfully, but these errors were encountered: