search

AzureAD / azure-activedirectory-library-for-js

The code for ADAL.js and ADAL Angular has been moved to the MSAL.js repo. Please open any issues or PRs at the link below.
https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/maintenance/adal-angular
Apache License 2.0
627 stars 374 forks source link

AADSTS50011: The reply url specified in the request does not match the reply urls configured for the application #859

Closed mohandivraniya closed 4 years ago

mohandivraniya commented 5 years ago

Our current setup is:

  1. SharePoint A SharePoint online site collection JavaScript running inside a content editor web part on a classic .aspx web part page on above site collection ADAL.js calling Azure AD to get token for Power BI end points for current logged in user.

  2. Azure AD An application is registered with reply URL https://<>/ oauth2AllowImplicitFlow and oauth2AllowUrlPathMatching are set to true.

  3. Other Chrome version 73 ADAL.js version 1.0.18

My ADAL.js ApplicationContext config is defined as:

var config = { instance: 'https://login.microsoftonline.com/', tenant: 'common', clientId: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx', postLogoutRedirectUri: window.location.origin, callback: acquireToken, endpoints: { 'https://api.powerbi.com': 'https://analysis.windows.net/powerbi/api', }, popUp: true, cacheLocation: 'localStorage' };

Now, when I call acquireToken method of ADAL.js, it opens a new popup and displays above error.

My questions are:

  1. Is my configuration incorrect?
  2. Does oauth2AllowUrlPathMatching work with aspx pages also? So, if I register my site collection URL as reply/redirect URL in Azure AD and then use above acquireToken method from any aspx page of that web site, should it work?
  3. Is ADAL.sj meant to work with SPAs only?
jmckennon commented 4 years ago

Could you please provide the error you're seeing if this is still an issue?

Additionally, your configuration is set up with popUp: true which will always popup a login window. You can set this to false to do a full redirect. You also don't need the callback: acquireToken field, as this effectively does nothing.

oauth2AllowUrlPathMatching should allow you to achieve this.

Yes, generally only with SPAs. See the wiki.

Also, all current authentication work from Microsoft is delivered through the msal js library here. adal js is still supported only for security fixes. We recommend moving to msal js for any advanced feature requests and bugfixes.

jmckennon commented 4 years ago

Ahh--I'm blind and didn't notice the error was actually in the title. My bad.

Nonetheless, if you're still seeing issues, please respond and we can guide some usage and debugging, as this sounds like a usage error. Double check to make sure that the redirectURI being set in the code (there is a default of window.location.href) and the one set in Azure are indeed the same.

jmckennon commented 4 years ago

Closing this as we're assuming this is no longer an issue. We recommend that everyone switch to msal js here for advanced features and bugfixes.