0
367
VisualizaçõesHow to Set Azure AD Redirect URI with Param
I am working on Azure AD Login Redirection and looking for a solution (if possible) which could allow me to "inject" an id into the redirect uri.
For more details, we have a Vue SPA and our CICD strategy is to deploy the feature branch codebase into Test environment for testing purpose. The deployment is triggered by Git pull request (from feature to main), so each pull request will have a unique deployment (as a review app for this PR change).
For example, each deployment is exposed by route https://xxxxx.{prId}.yyyy.io. By this strategy we could isolate the testing for each Jira ticket.
However this causes the redirect uri config trouble since it asks to config fixed uris in the above screenshot. I definitely do not want to input every prid-identified route into AD manually.
Question is:
(1) Suppose I have a new deployment with route https://xxxxx.pr10.yyyy.io, is there a way not to input it in AD, and AD just redirects me to current route after login?
(2) I know there could be a wildcard solution (maybe not supported any more), but if I have two or more PRs, https://xxxxx.pr10.yyyy.io, https://xxxxx.pr11.yyyy.io and have wildcard uri in AD as https://xxxxx.pr*.yyyy.io, how could AD know which route to redirect me to?
(3) The last solution could be change this cicd strategy to traditional git flow, which is to push all code changes into a Test branch and deploy this Test branch to route https://xxxxx.test.yyyy.io, this could give us a fixed uri, but this causes testing isolation difficulty and cicd migration cost. Then the general question is is there any way we could stick to our current CICD but using AD? Thanks.
1 Respostas
Responde à pergunta0
After deep doc reading of the official article Redirect URI (reply URL) restrictions and limitations
Wildcard uri is still supported but with some limited scope:
Wildcard URIs are currently unsupported in app registrations configured to sign in personal Microsoft accounts and work or school accounts. Wildcard URIs are allowed, however, for apps that are configured to sign in only work or school accounts in an organization's Azure AD tenant.
The key point is you can not add a wildcard uri for example https://*.domain.com in the web page directly, instead you get to go to the manifest editor and input it.
To add redirect URIs with wildcards to app registrations that sign in work or school accounts, use the application manifest editor in App registrations in the Azure portal.
As MS said:
we strongly recommend you adhere to section 3.1.2 of RFC 6749. and use only absolute URIs.
But since my case is more testing purpose, so it is acceptable. For production, better not.