ASP.NET Core Controller authorization issue due to lack of redirect uri in OKTA

As I was playing with the Sitecore MVP Site local instance' asp.net core controllers, I realized, I wasn't able to access the application controller due to OKTA authorization issues. For some overview, here is how OKTA helps in authorization of the MVP website:


So, OKTA needs a specific redirect uri  and this will change based on your instance name!

To explain the issue better, here is the SignIn link in the Sitecore MVP Site;


A couple of step backwards,  if you access this asp.net core controller endpoint without signing in, you will get this json response:

For some more background, you can see this logic in the corresponding controller methods:


So, now the goal is to login to the site in order to be able to get authenticated and get access to these api methods but, I received the following error on clicking the signin link in the home page header:  

Error: The 'redirect_uri' parameter must be a Login redirect URI in the client app settings: https://dev-8977927-admin.okta.com/admin/app/oidc_client/instance/0oa3h5v0tmbaDowYO5d7#tab-general


It took me sometime to realize that I could access the highlighted url (above screen shot) in the browser and when I did, I was taken to the OKTA settings page:


And, in the settings page, I realized I needed to add a redirect url expected by OKTA to give access to the MVP local instance, I initially added just the local instance' domain name as follows:



But, the error wouldn't still go. Then, I realized, the redirect_uri query string param actually pointed to https://mvp.sc.localhost/authorization-code/callback

So,  I modified OKTA settings to reflect this actual url as follows:


Now, when I access the signin link, I could access the OKTA login page:

Once I logged in to OKTA with my credentials, OKTA redirected automatically to the logged-in local instance:



Now, the asp.net core controller endpoints were accessible:

Application info endpoint:

Application list:



Note that a similar redirect uri has to be setup for logout too in OKTA!

Comments