redirect ignoring port

[LanceSandino]

Hi.... Not sure if I'm doing something wrong, but after sign in (from URL: https://sub.domain.com:PORT) it redirects me to https://sub.domain.com [NO PORT]

Current Setup: nginx.conf sample

server {

        listen       7002 ssl default_server;
        # Load global SSL config
        include /etc/nginx/default.d/ssl.conf;

        # Load configuration files for the default server block.
        # include /etc/nginx/default.d/*.conf;

        # Load global Error Page config
        include /etc/nginx/default.d/error_pages.conf;
  location /oauth2/ {
    proxy_pass       https://sub.domain.com;
    proxy_set_header Host                    $host;
    proxy_set_header X-Real-IP               $remote_addr;
    proxy_set_header X-Scheme                $scheme;
    proxy_set_header X-Auth-Request-Redirect $request_uri;
  }
  location = /oauth2/auth {
    proxy_pass       https://sub.domain.com;
    proxy_set_header Host             $host;
    proxy_set_header X-Real-IP        $remote_addr;
    proxy_set_header X-Scheme         $scheme;
    # nginx auth_request includes headers but not body
    proxy_set_header Content-Length   "";
    proxy_pass_request_body           off;
  }
        # Proxy to port 8xxx
        location / {
        auth_request /oauth2/auth;
    error_page 401 = /oauth2/sign_in;

    # pass information via X-User and X-Email headers to backend,
    # requires running with --set-xauthrequest flag
    auth_request_set $user   $upstream_http_x_auth_request_user;
    auth_request_set $email  $upstream_http_x_auth_request_email;
    proxy_set_header X-User  $user;
    proxy_set_header X-Email $email;

    # if you enabled --cookie-refresh, this is needed for it to work with auth_request
    auth_request_set $auth_cookie $upstream_http_set_cookie;
    add_header Set-Cookie $auth_cookie;
            proxy_pass http://localhost:8002;
            # Load global Proxy config
            include /etc/nginx/default.d/proxy.conf;
        }

}

oauth2_config.cfg

## OAuth2 Proxy Config File
## https://github.com/bitly/oauth2_proxy

# Provider, override default Google
provider = "azure"

## <addr>:<port> to listen on for HTTP/HTTPS clients
http_address = "127.0.0.1:4180"
#https_address = ":443"

## TLS Settings
# tls_cert_file = ""
# tls_key_file = ""

## the OAuth Redirect URL.
# defaults to the "https://" + requested host header + "/oauth2/callback"
#redirect_url = "https:///oauth2/callback"

## the http url(s) of the upstream endpoint. If multiple, routing is based on path
upstreams = [
    "http://127.0.0.1/"
]

## Log requests to stdout
request_logging = true

## pass HTTP Basic Auth, X-Forwarded-User and X-Forwarded-Email information to upstream
pass_basic_auth = true
pass_user_headers = true
## pass the request Host Header to upstream
## when disabled the upstream Host is used as the Host Header
pass_host_header = true 

## Email Domains to allow authentication for (this authorizes any email on this domain)
## for more granular authorization use `authenticated_emails_file`
## To authorize any email addresses use "*"
email_domains = [
    "domain.com"
]

# Azure AD
## The OAuth Client ID, Secret
client_id = "my-client-id"
client_secret = "my-client-secret"

## Pass OAuth Access token to upstream via "X-Forwarded-Access-Token"
# pass_access_token = false

## Authenticated Email Addresses File (one email per line)
# authenticated_emails_file = ""

## Htpasswd File (optional)
## Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
## enabling exposes a username/login signin form
# htpasswd_file = ""

## Templates
## optional directory with custom sign_in.html and error.html
custom_templates_dir = "/opt/go/bin/"

## skip SSL checking for HTTPS requests
# ssl_insecure_skip_verify = false

## Cookie Settings
## Name     - the cookie name
## Secret   - the seed string for secure cookies; should be 16, 24, or 32 bytes
##            for use with an AES cipher when cookie_refresh or pass_access_token
##            is set
## Domain   - (optional) cookie domain to force cookies to (ie: .yourcompany.com)
## Expire   - (duration) expire timeframe for cookie
## Refresh  - (duration) refresh the cookie when duration has elapsed after cookie was initially set.
##            Should be less than cookie_expire; set to 0 to disable.
##            On refresh, OAuth token is re-validated. 
##            (ie: 1h means tokens are refreshed on request 1hr+ after it was set)
## Secure   - secure cookies are only sent by the browser of a HTTPS connection (recommended)
## HttpOnly - httponly cookies are not readable by javascript (recommended)
cookie_name = "random_cookie"
cookie_secret = "randomstuff"
cookie_domain = ".sub.domain.com"
cookie_expire = "168h"
cookie_refresh = "84h"
cookie_secure = true
cookie_httponly = true

Let me know if you need more information :)

[ploxiln]

This might be because

proxy_set_header Host                    $host;

omits the original port, so there's no good way for oauth2_proxy to know what it was. Usually this is fine, if you use the default http or https port, but in your case it doesn't work out ...

[LanceSandino]

I think I have it figured out... but now I have a different problem...

AADSTS50011:: The reply address 'https://sub.domain.com:7303/oauth2/callback' does not match the reply addresses configured for the application: 'XXXX-xxxx-xxxxx-XXXX'. More details: not specified

I tried using redirect_url (to avoid having to add EACH reverse proxy port I have to the Reply URL's of Azure...) but then I have the initial issue I had before -> redirecting without the port.....