4

We have an application that we want to host only once but allow 2 different domains to direct to the one instance then we change the branding based on the incoming host. For instance https://app.abc.com points the same instance as https://app.def.com.

So they are not subdomains but rather independent domains. This would mean they also share the same Azure registered application but different return url's https://app.abc.com/auth/openid/return and https://app.def.com/auth/openid/return.

The Azure portal, however, gives the error

"You may not use more than 1 external domain(s)"

.

Is there any way around this without having to host 2 instances of the same application, each with the own Azure application/client id?

Wayne Yang
  • 9,016
  • 2
  • 20
  • 40
chookie
  • 441
  • 6
  • 12
  • FYI: [Why is Redirect URL Fully Qualified in Azure AD B2C?](https://stackoverflow.com/questions/47520604/why-is-redirect-url-fully-qualified-in-azure-ad-b2c) – spottedmahn Apr 13 '18 at 12:51
  • this seems to work now, even though the info box still shows "Redirect URIs must all belong to the same domain" – Markus Dresch Aug 14 '19 at 08:19

3 Answers3

4

As Wayne mentioned, it is not currently possible to reply to multiple domains.

However, one workaround is to build a proxy in one of the websites. You always redirect to this proxy, which then redirects to the proper site. You could use the state parameter to store which "site" the user clicked "sign in" from, and then based on that redirect properly. You would have to be careful in making sure the token is passed through securely.

Parakh
  • 1,202
  • 7
  • 16
  • Thanks Parakh. I will give it a try. – chookie Apr 04 '18 at 08:09
  • This restriction has been lifted - https://stackoverflow.com/questions/57495254/azure-b2c-accepting-different-domains-in-redirect-uris-bug-or-feature . Just tried with two different hostnames on the portal and the configuration was saved without errors. – reim Sep 14 '20 at 12:29
3

Unfortunately, you cannot achieve this.

Reply URLs must all belong to the same domain. And Redirect URIs must all belong to the same domain .This is a limitation for AAD B2C application Registration.

You can also see this note in Azure portal:

enter image description here

Is there any way around this without having to host 2 instances of the same application, each with the own Azure application/client id?

For Web API or Web App, as I known, there is no way to achieve this for now.

I suggest you can upvote this idea in this Uservoice Page, AAD B2C Team will review it.

Hope this helps!

Wayne Yang
  • 9,016
  • 2
  • 20
  • 40
1

In case anyone stumbles across this issue as I did today, I found a workaround for this.

Caution: This method is not officially supported by MS according to a warning from MS in the Azure portal (see the second screenshot)

1) In your B2C tenant, navigate "All services --> search for "App registrations" --> click "App Registrations" All services --> App registrations screenshot

2) Find your application in the application list and click on it. Note the warning from MS (see screenshot) App registration list screenshot

3) Click on "Authentication" and add your Redirect URIs to the list. This is the same UI as non-B2C tenants. Redirect URI list screenshot

It allowed me to enter redirect URIs with different domains. It doesn't appear to have the limitation as the "Azure AD B2C" blade. I had to wait a minute for the change to propagate, but it worked for me. I'm not going live with this anytime soon, so I'm ok with doing this for now. When I do decide to go live I'll probably find some other way of doing what I want if MS still hasn't green-lit this method.

Again, MS warns against using this at the moment, but hopefully they'll officially support it soon.

AGDevX
  • 71
  • 3
  • interesting find. i also just found out today that it's possible to add any domains now in the normal b2c blade, even though the Reply URLs tooltip says it's not possible. and it works. – Markus Dresch Aug 14 '19 at 08:16