Azure / Azure/api-management-developer-portal
Auth Code with PKCE Flow does not work when the Auth Server contains uppercase in its name / Id
- Dominant language
- TypeScript
- Stars
- 545
- Forks
- 360
- PR merge metrics
- No merged PRs in 30d
Description
> [!IMPORTANT]
> **PLEASE DO NOT CREATE ISSUES RELATED TO MANAGED DEVELOPER PORTAL IN THIS REPOSITORY**. Issues related to "Managed developer portal" will be closed automatically. Managed developer portal issues should be created directly in Azure Support + Troubleshooting in Azure portal. Contact Azure support (or) submit a post [on Stack Overflow](http://aka.ms/apimso). Feature requests can be raised [on the Azure Feedback Forum](https://aka.ms/apimwish).
Every self-hosted developer bug report should have precise description and reproduction steps; console traces (or) source code references are appreciated.
## Bug description
When the OAuth 2.0 Auth Server for the Developern Portal contains upper case letters in its name/Id the Auth Code with PKCE Flow does not work because of insistent Redirect URIs casing. (First request uses lowercase, second uppercase). Because of that the Entra ID and potential every other IDP rejects the login request because the redirect URIs do not match.
## Reproduction steps
1. Go to in Azure Portal go to APIM > Deverloper Portal > OAuth 2.0 + OpenID Connect
2. Click on 'Add'
3. Create an OAuth 2.0 Auth Server with uppercase in the Id. For example: "OAuth2".
4. Assign the Auth Server to an API
5. Go to Developer Portal and try out the API
6. Select "authorization_code (PKCE)" as the Authorization Flow
7. Pop Up appears which tries to login the user
8. Login fails because redirect URI for the first (auth) request is not the same as for the second (token) request. For example, with Entra ID the following Error is shown:
{"error":"invalid_client","error_description":"AADSTS500112: The reply address 'https://api-portal.example.com/signin-oauth/code-pkce/callback/OAuth2' does not match the reply address 'https://api-portal.example.com/signin-oauth/code-pkce/callback/oauth2' provided when requesting Authorization code.}
## Expected behavior
Correctly login the use and get an Access Token.
## Is self-hosted portal?
No (and Yes)
> [!WARNING]
> "Managed developer portal issues" will be closed automatically. See above for more details.
## Release tag or commit SHA (if using self-hosted version)
2.34.0
## API Management service name
N/A
## Environment
N/A
## Additional context
For first request makes URL lowercase: https://github.com/Azure/api-management-developer-portal/blob/master/src/services/oauthService.ts#L197
But second request does not (but it should too): https://github.com/Azure/api-management-developer-portal/blob/master/src/services/oauthService.ts#L213
Contributor guide
No contributing guide indexed for this repository
Research direction
Inspect src/services/oauthService.ts at the referenced lines 197 and 213, then reproduce the authorization_code (PKCE) flow with an Auth Server ID such as "OAuth2". Compare the redirect URIs used by both requests; done means they retain matching casing and the login completes with an access token.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 58/100