AADSTS50011: The reply url specified in the request does not match the reply urls configured for the application: ''

Question

I have a .NET Core 2 app template that is configured to use Azure AD out of the box.

The configuration is:

{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "lautaroarinolive.onmicrosoft.com",
    "TenantId": "67cb2dfd-ebd5-40d8-829b-378340981a17",
    "ClientId": "50819a7a-e018-4c1d-bf0a-18c8fce5c600",
    "CallbackPath": "/signin-oidc"
  },
  "Logging": {
    "IncludeScopes": false,
    "LogLevel": {
      "Default": "Warning"
    }
  }
}

In my portal, I have an Azure app registration with the same id as ClientId. It has the reply URL [APP-URL]/signin-oidc.

The localhost app works only if I set the reply URL to [LocalhostURL]/signin-oidc, even though I've learned that the configuration should not affect log in on localhost.

The Azure app does not work in any case.

In both apps when it doesn't work I get this error:

AADSTS50011: The reply url specified in the request does not match the reply urls configured for the application: '50819a7a-e018-4c1d-bf0a-18c8fce5c600'

Is it correct that a localhost app should not need a configured reply URL?
Why do I get the "reply url not configured" error?

After publishing the application to azure web app service, The reply url should just be the `/signin-oidc`. Is this a new AAD app ? — Wayne Yang, Apr 25 '18 at 01:27
It's weird. Which sample are you using? I will do a deep test for this. — Wayne Yang, Apr 25 '18 at 05:26
Thank you! I chose Net Core 2 MVC Application With Authentication set to work, single organization. — Daarwin, Apr 25 '18 at 05:28
Oh it wasnt possible i guess. Here is a dl link. https://drive.google.com/file/d/11fQ0UiQWELF7L4Z6aOsU1P_YCFsgHq0k/view?usp=sharing — Daarwin, Apr 25 '18 at 05:36
Let us [continue this discussion in chat](https://chat.stackoverflow.com/rooms/169718/discussion-between-wayne-yang-msft-and-lautaro). — Wayne Yang, Apr 25 '18 at 05:43
Have you reffered to this Sample:https://github.com/Azure-Samples/active-directory-dotnet-webapp-openidconnect-aspnetcore — Wayne Yang, Apr 25 '18 at 05:45
Do you mean if I have looked at it? No I haven’t. Should I use it as reference? — Daarwin, Apr 25 '18 at 05:46
Yep, you can refer to this Sample to intergrate your Application with AAD.:-) — Wayne Yang, Apr 25 '18 at 05:47
It looks very much like what comes out from creating a new template. I’ll give it a try though. — Daarwin, Apr 25 '18 at 05:49
@WayneYang-MSFT I tried the project from Git you linked to me. I made a new app in azure portal and registered it in AzureAD. I changed the replyURL accordingly, but for it to work i also had to change the App ID Uri which also is wrong by default. So now it works on Azure , yay! But it still wont work in my localhost. You said something about that localhost should not use HTTPS? It does by default though could that be a problem? Overall i get the impression that when login works in azure it doesnt work in localhost, and the other way around. — Daarwin, Apr 25 '18 at 09:01
@WayneYang-MSFT Sorry my mistake. I was using http in the localhost. "http://localhost:61659/" — Daarwin, Apr 25 '18 at 09:06

score 19 · Accepted Answer · edited Feb 09 '21 at 05:46

19

You can refer to this Sample to rebuild your .NET core App and publish to the Azure.

There are some NOTES you need to pay attention to :

you need to change the port from 5000 to the effective one. Currently, it should be 61659. So, when you do a test in your localhost, you can set the reply URL in the AAD App with http://localhost:61659/signin-oidc
Update these URLs if you configure the app for production use or If you publish the App to Azure Web App, you should change the Reply URL in both App config file and AAD Application to be <AppURL>/signin-oidc

For example, https://www.contoso.com/signin-oidc or https://Myapp.azurewebsites.net/signout-oidc.

edited Feb 09 '21 at 05:46

Anirban Saha

1,350
2
10
38

answered Apr 25 '18 at 09:15

Wayne Yang

9,016
2
20
40

Ok so its not possible to have it configured for localhost and Azure Web App at the same time? – Daarwin Apr 25 '18 at 09:17
1

Now it works. Both localhost and in azure. I added both reply URL:s. In your example, i added both http://localhost:61659/signin-oidc and https://Myapp.azurewebsites.net/signout-oidc and now i can login both online in azure app and in localhost. – Daarwin Apr 25 '18 at 09:29
Yep, you cannot add different domain in the reply URLs, but you can add the localhost .When you publish your App to azure, you needn't to configure the localhost in Azure.If you also want to lgoin with localhost, you can just add localhost in the reply urls – Wayne Yang Apr 25 '18 at 10:09
1

Hi @whihathac , you can see the restriction here:https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-limitations#restrictions-on-redirect-uris – Wayne Yang May 14 '18 at 01:30
This answer makes no sense. You dont say anywhere in the answer what file you need to change. I currently dont see any file that has a port. – Darth Scitus Apr 30 '20 at 18:19

score 17 · Answer 2 · edited Jun 17 '19 at 20:10

17

I had a similar problem with a .NET 4.6.1 web application. I had to configure the Reply URL for my app in azure similar to the accepted answer, however the callback url was different.

Select Azure Active Directory -> App Registrations -> <your app>
Select Settings -> Reply URLs

Add your apps URL + '/.auth/login/aad/callback' For Example: https://somesite.azurewebsites.net/.auth/login/aad/callback

edited Jun 17 '19 at 20:10

mbomb007

3,788
3
39
68

answered Oct 23 '18 at 19:25

armstb01

623
8
11

1

I agree with your solution, '/.auth/login/aad/callback' – Daleman Nov 07 '19 at 02:45
2

`/.auth/login/aad/callback` appears to be hardcoded redirect path AzureAD/Microsoft signin provider will redirect to on successful sign-in. If you don't have `https://${yoursite}/.auth/login/aad/callback` in your reply-urls, sign in with Microsoft online will throw error AADSTS50011. – PotatoFarmer Jun 04 '20 at 21:07
Adding `https://${yoursite}/.auth/login/aad/callback` as the RedirectURI was the trick! – TetraDev Aug 24 '21 at 18:10

PRTJ · Answer 3 · 2021-07-06T08:57:42.630

Check your redirect uri in your Microsoft sign in page

redirect_uri=https://localhost:8443/login&response_type=code&scope=openid%20profile&state=7GsiHb

And make sure that you have added the same URI to redirect URI list in your registered application (Active Directory -> App Registration -> Your Application). As mentioned in other answers may need to change supported account type as "Multiple Organizations".

Ivan Neganov · Answer 4 · 2021-06-04T19:56:26.433

Just got the same error. My app is a .NET 5 ASP.NET Core app running in a Linux docker container inside of a web app. Troubleshooting using Fiddler has shown that in calls to login.microsoft.com the value of a redirect_uri query string variable was starting with "http://" and not with "https://" as I would expect despite my attempts to enforce TLS-only on the web app itself. That led to URL mismatch and to the error AADSTS50011.

Setting the environment variable ASPNETCORE_FORWARDEDHEADERS_ENABLED=true on the web app has fixed the issue. Microsoft has documented it here: https://devblogs.microsoft.com/aspnet/forwarded-headers-middleware-updates-in-net-core-3-0-preview-6/

score 1 · Answer 5 · edited Oct 07 '19 at 16:34

Make sure services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1); must below the Authentication configuration.

services.AddAuthentication(options =>
{
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
    options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddOpenIdConnect(options =>
{
    options.Authority = "";
    options.ClientId = "";
    options.ResponseType = OpenIdConnectResponseType.IdToken;
    options.CallbackPath = "";
    options.SignedOutRedirectUri = "";
    options.TokenValidationParameters.NameClaimType = "name";
})
.AddCookie();

I was facing the same error due to having added AddMvc() before the AddAuthentication() extension method.

score 1 · Answer 6 · answered Feb 03 '20 at 16:36

1

In some case, azure to use the 'www' on the url, even if you especific the url on the portal without 'www'. Use "https://www.mysite.co/signin-oidc" instead "https://mysite.co/signin-oidc" in your redirectUri variable.

answered Feb 03 '20 at 16:36

Oscar Javier Jimenez

109
1
3

This worked for me. I was searching for errors and followed every other step but this one helped. Thank you. – M Stoerzel Feb 08 '23 at 20:44

score 0 · Answer 7 · answered May 05 '20 at 13:20

0

Small thing, but at the Web Tenant, at custom domains settings HTTPS Only option should be turned on depending on URLs used by the site. I had the same problem, as at the login, the redrect_uri=http://sitename was concatenated instead of https. Enabling this option resolved my authentication issue.

answered May 05 '20 at 13:20

Ádám Géczi

166
5

Where is this option? I the azure portal? – MrEs Jul 23 '20 at 05:20
Yes. At the web tentant, settings/custom domains HTTPS only setting can handle this. – Ádám Géczi Aug 10 '20 at 14:47

score 0 · Answer 8 · answered Oct 02 '20 at 02:41

0

If you are signing in from AAD you should use app-base-url/sigin-aad.

answered Oct 02 '20 at 02:41

Ronald Abellano

774
10
34

score 0 · Answer 9 · edited Nov 18 '20 at 08:30

0

If you use React- Native. Able to check the web portal: https://portal.azure.com/.

iOS: {YOUR_BUNDLE_IDENTIFIER}://{YOUR_BUNDLE_IDENTIFIER}/ios/callback

Android: {YOUR_APP_PACKAGE_NAME}://{YOUR_APP_PACKAGE_NAME}/android/callback

pls refer with image below.

enter image description here

edited Nov 18 '20 at 08:30

Simas Joneliunas

2,890
20
28
35

answered Nov 18 '20 at 05:47

Nguyen Van Linh

11
3

Your image is not displaying – SendETHToThisAddress Jan 27 '21 at 20:02

Mike Miller · Answer 10 · 2021-07-30T12:31:39.127

The only solution for me: in the Azure portal https://portal.azure.com, navigate to "app registrations" -> select your application -> "authentication" from the left sidebar menu -> "mobile and desktop applications" redirect URIs -> and click "Add URI" -> type the following

ms-appx-web://microsoft.aad.brokerplugin/{Your_Application's_Client_ID}

Example: ms-appx-web://microsoft.aad.brokerplugin/5r3257qe-7jci-3501-38k0-3791h90542m7

AADSTS50011: The reply url specified in the request does not match the reply urls configured for the application: ''

10 Answers10

Linked