This check is executed only if the transaction was started using a shortcut (SAP GUI for Windows), using a start transaction (SAP GUI for Java), or using a URL (SAP GUI for HTML). This SAPGUI Shortcut passes the same parameters as the above STRING called in the OKFieldCode. Figure 4–11 SAP Config Tool: Configuring the ume.logoff.redirect.url Parameter Previous: To Modify the Ticket Template to Use the New Login Module for SAP Enterprise Portal 7.0 Next: To Enable Cookie Reset for SAP Enterprise Portal 7.0.

-->

A redirect URI, or reply URL, is the location where the authorization server sends the user once the app has been successfully authorized and granted an authorization code or access token. The authorization server sends the code or token to the redirect URI, so it's important you register the correct location as part of the app registration process.

The following restrictions apply to redirect URIs:

• The redirect URI must begin with the scheme https. There are some exceptions for localhost redirect URIs.

• The redirect URI is case-sensitive. Its case must match the case of the URL path of your running application. For example, if your application includes as part of its path ../abc/response-oidc, do not specify ../ABC/response-oidc in the redirect URI. Because the web browser treats paths as case-sensitive, cookies associated with ../abc/response-oidc may be excluded if redirected to the case-mismatched ../ABC/response-oidc URL.

• Beginning with release 7.2 the SAP Web Dispatcher is now able to rewrite URL (as Apache) and not only to redirect URLs. It means that it is now possible to use the technique number 3 with a SAP web dispatcher. No more need to cascade an Apache reverse proxy (for URL rewriting) and a SAP Web Dispatcher (for load balancing).
• Then, what if you -need- to follow a redirection? (side-note: as CPI is constantly evolving, this could be enabled directly by SAP in a future release) 1.- Following a redirection. In apache Camel, is not difficult to include and configure a clientConfig option for the AHC component. This configuration, will allow us to enable the redirections.
• What would be the redirect URL to use for your OAuth 2 Get Token method to work? Maybe I’m missing something here, but I have no clue! Note that when I get the token with a test client and copy / paste it in the box, it works. It’s just the Get Token Window that is not working. I get the login screen and the grant screen too, but the.

Maximum number of redirect URIs

This table shows the maximum number of redirect URIs you can add to an app registration in the Microsoft identity platform.

Accounts being signed in	Maximum number of redirect URIs	Description
Microsoft work or school accounts in any organization's Azure Active Directory (Azure AD) tenant	256	signInAudience field in the application manifest is set to either AzureADMyOrg or AzureADMultipleOrgs
Personal Microsoft accounts and work and school accounts	100	signInAudience field in the application manifest is set to AzureADandPersonalMicrosoftAccount

Maximum URI length

You can use a maximum of 256 characters for each redirect URI you add to an app registration.

Supported schemes

The Azure Active Directory (Azure AD) application model currently supports both HTTP and HTTPS schemes for apps that sign in work or school accounts in any organization's Azure AD tenant. These account types are specified by the AzureADMyOrg and AzureADMultipleOrgs values in the signInAudience field of the application manifest. For apps that sign in personal Microsoft accounts (MSA) and work and school accounts (that is, the signInAudience is set to AzureADandPersonalMicrosoftAccount), only the HTTPS scheme is allowed.

To add redirect URIs with an HTTP scheme to app registrations that sign in work or school accounts, you need to use the application manifest editor in App registrations in the Azure portal. However, though it's possible to set an HTTP-based redirect URI by using the manifest editor, we strongly recommend that you use the HTTPS scheme for your redirect URIs.

Localhost exceptions

Per RFC 8252 sections 8.3 and 7.3, 'loopback' or 'localhost' redirect URIs come with two special considerations:

1. http URI schemes are acceptable because the redirect never leaves the device. As such, both of these URIs are acceptable:
   • http://localhost/myApp
   • https://localhost/myApp
2. Due to ephemeral port ranges often required by native applications, the port component (for example, :5001 or :443) is ignored for the purposes of matching a redirect URI. As a result, all of these URIs are considered equivalent:
   • http://localhost/MyApp
   • http://localhost:1234/MyApp
   • http://localhost:5000/MyApp
   • http://localhost:8080/MyApp

From a development standpoint, this means a few things:

• Do not register multiple redirect URIs where only the port differs. The login server will pick one arbitrarily and use the behavior associated with that redirect URI (for example, whether it's a web-, native-, or spa-type redirect).

  This is especially important when you want to use different authentication flows in the same application registration, for example both the authorization code grant and implicit flow. To associate the correct response behavior with each redirect URI, the login server must be able to distinguish between the redirect URIs and cannot do so when only the port differs. Mickey mouse club dvds.

• If you need to register multiple redirect URIs on localhost to test different flows during development, differentiate them using the path component of the URI. For example, http://localhost/MyWebApp doesn't match http://localhost/MyNativeApp.

• The IPv6 loopback address ([::1]) is not currently supported.

Prefer 127.0.0.1 over localhost

To prevent your app from being broken by misconfigured firewalls or renamed network interfaces, use the IP literal loopback address 127.0.0.1 in your redirect URI instead of localhost. For example, https://127.0.0.1.

You cannot, however, use the Redirect URIs text box in the Azure portal to add a loopback-based redirect URI that uses the http scheme:

To add a redirect URI that uses the http scheme with the 127.0.0.1 loopback address, you must currently modify the replyUrlsWithType attribute in the application manifest.

Restrictions on wildcards in redirect URIs

Wildcard URIs like https://*.contoso.com may seem convenient, but should be avoided due to security implications. According to the OAuth 2.0 specification (section 3.1.2 of RFC 6749), a redirection endpoint URI must be an absolute URI.

Wildcard URIs are currently unsupported in app registrations configured to sign in personal Microsoft accounts and work or school accounts. Wildcard URIs are allowed, however, for apps that are configured to sign in only work or school accounts in an organization's Azure AD tenant.

To add redirect URIs with wildcards to app registrations that sign in work or school accounts, you need to use the application manifest editor in App registrations in the Azure portal. Though it's possible to set a redirect URI with a wildcard by using the manifest editor, we strongly recommend you adhere to section 3.1.2 of RFC 6749 and use only absolute URIs.

If your scenario requires more redirect URIs than the maximum limit allowed, consider the following state parameter approach instead of adding a wildcard redirect URI.

Use a state parameter

If you have several subdomains and your scenario requires that, upon successful authentication, you redirect users to the same page from which they started, using a state parameter might be helpful.

Url Redirect Checker

In this approach:

1. Create a 'shared' redirect URI per application to process the security tokens you receive from the authorization endpoint.
2. Your application can send application-specific parameters (such as subdomain URL where the user originated or anything like branding information) in the state parameter. When using a state parameter, guard against CSRF protection as specified in section 10.12 of RFC 6749).
3. The application-specific parameters will include all the information needed for the application to render the correct experience for the user, that is, construct the appropriate application state. The Azure AD authorization endpoint strips HTML from the state parameter so make sure you are not passing HTML content in this parameter.
4. When Azure AD sends a response to the 'shared' redirect URI, it will send the state parameter back to the application.
5. The application can then use the value in the state parameter to determine which URL to further send the user to. Make sure you validate for CSRF protection.

Warning

This approach allows a compromised client to modify the additional parameters sent in the state parameter, thereby redirecting the user to a different URL, which is the open redirector threat described in RFC 6819. Therefore, the client must protect these parameters by encrypting the state or verifying it by some other means, like validating the domain name in the redirect URI against the token.

Next steps

Url Redirect Service

Learn about the app registration Application manifest.

I was looking for a consistent way to be able to know the url a user was coming from when loading a page. I came across the Request.UrlReferrer property of the page, and thought “hey, this is exactly what I need!”, but that wasn’t the case. It was working in some instances, and was coming up null in other instances, I wasn’t sure exactly what causing the null value so I did a little research. Basically this referrer property is optionally set by the browser, and should never really be relied on to be consistent.

From http://forums.asp.net/t/1097333.aspx/1 “gopalanmani” lays it out pretty clearly. Thanks!

The situations where it does work include the following methods of a browser loading a URL:

• clicking on a straight HTML <a href> link;
• submitting a form, using POST or GET, from a submit button, <input type=image> or client-side script (form.submit())

The situations where it doesn’t work:

• using Response.Redirect / Server.Transfer;
• clicking on a Favorite, History, or the recently-typed URLs list;
• clicking on ‘Home’ in IE’s toolbar, or an item in IE’s ‘Links’ toolbar;
• using location.href or location.replace() in client-side JScript/JavaScript/VBScript;
• using HierMenus (details);
• typing the URL directly in the browser and hitting Enter or clicking ‘Go’;
• launching a clickable URL from an e-mail or MS Office document;
• using Response.AddHeader or <meta http-equiv=refresh> to redirect;
• loading the URL with XML

So basically, beware when using this property. Depending on what browser is being used, and how the user came to the page, this property may not be consistently set.