Search code examples
oauth-2.0openid-connectokta

Configure variable callback URI in Okta

I'm trying to configure a new Okta application with a callback URL that will depend on the tenant's subdomain. Meaning I need the same Okta app to accept redirection (using the redirect_uri parameter) to https://0001.my.domain.com/oauth2/callback, https://0002.my.domain.com/oauth2/callback and so on. Notice the 0001 and 0002 subdomains. This may seem strange, but it's for demo purposes. The point is to avoid having to set up a different Okta app per tenant.

Okta's own docs on the subject read:

Does your Initiate Login URI vary by tenant? — If Yes, enter which part of the Initiate Login URI is customizable. For example, the subdomain in https://<subdomain>.example.com/signin/.

enter image description here

However, when I try to do this I run into an error complaining that:

The redirect URIs must be absolute URIs.

enter image description here

Maybe I'm just reading this wrong, but I take it to mean that variables/placeholders are supported.

I've searched the rest of the Okta docs but found no additional information on the subject.

Solution

  • If Okta let you do this, it would not be OAuth 2.0 compliant.

    See https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-16#section-2.1:

    When comparing client redirect URIs against pre-registered URIs, authorization servers MUST utilize exact string matching except for port numbers in "localhost" redirection URIs of native apps.