How to use wildcard inside domain name in Redirect URIs (Azure AD)

Question

There have been some questions regarding this issue on StackOverflow, but none of them have a well-defined answer.

I am trying to enable SSO authentication with Azure AD for Grafana. My Grafana domains look like this:

monitoring.cluster1.company.com
monitoring.cluster2.company.com
monitoring.cluster3.company.com

I have a couple hundred of these.

In the app manifest, I tried setting up redirect URIs in multiple ways:

https://*.company.com/login/azuread -> does not match my URL
https://monitoring.*.company.com/login/azuread -> Azure does not accept it

Is there really any way to circumvent this? I read about a solution involving cookies, but I honestly did not understand how that works or how it can be applied.

Answer 1

Note that: Azure AD supports redirect URL of wildcard type https://*.xxx.com but not https://xxx.*.abc.com type. Refer this MsDoc.

I created an Azure AD Application and tried to add redirect URL as https://monitoring.*.company.com/login/azuread .

And got the error like below:

As a workaround you have to update the redirect URL as https://*.company.com/login/azuread

• Due to security issues, wildcard URIs should be avoided.
• A redirection endpoint URI must be an absolute URI according to OAuth 2.0 specification.
• Otherwise, if you want to add https://monitoring.*.company.com/login/azuread as redirect URL you have to add manually as

https://monitoring.cluster1.company.com/login/azuread https://monitoring.cluster2.company.com/login/azuread

Reference:

Azure AD wildcard in middle((not at the end or beginning)) of reply url not working - Stack Overflow by alphaz18