DRACOON cloud status: ‍‍

Now available:  Virus protectionLearn more

Articles in this section

For OpenID Connect administrators: Required change of the redirect URI

  • Updated
Follow

This information is intended for system administrators of DRACOON environments where OpenID Connect is already used for login. For these environments, the existing DRACOON settings have to be adjusted in the OpenID provider configuration: An additional redirect URI needs to be added.

What is a redirect URI?

When using OpenID Connect, so-called redirect URIs are used. Redirect URIs are provided by applications that support OpenID Connect, such as DRACOON. Redirect URIs serve as a communication interface between the OpenID provider (IDP), which does the user authentication, and the target application (e.g. DRACOON), which performs the subsequent user authorization.

The respective OpenID provider must be aware of all required redirect URIs of the applications connected via OpenID Connect so that it can call the redirect URIs after each successful user authentication and thus the subsequent login to the respective application is possible using the token transferred in the redirect URI.

What are the changes in DRACOON regarding the redirect URI?

The redirect URI of DRACOON is currently /oauth/perform_login.
In the future, /oauth/openid-callback will be used as redirect URI instead.

For DRACOON cloud users the change will be effective in winter 2020 (exact date will be provided), for on-premises users with the release of DRACOON Server in December 2020.

Example: If your environment hosted on the DRACOON cloud can be reached at https://dracoon.company.com, the redirect URI for this is currently https://dracoon.company.com/oauth/perform_login. In the future, the redirect URI would be changed to https://dracoon.company.com/oauth/openid-callback.

What needs to be done?

If your users sign in to DRACOON using OpenID Connect, you have to add the new redirect URI /oauth/openid-callback in the configuration of your OpenID provider for DRACOON, so that signing in to DRACOON continues to work on the DRACOON cloud after December 2020 or after the release of DRACOON Server (for on-premises users), respectively.

Can the existing redirect URI simply be replaced with the new one?

No, because the previous redirect URI /oauth/perform_login is still needed for a transitional period. As a result, you should add the new redirect URI /oauth/openid-callback in the configuration of your OpenID provider for DRACOON and keep the current entry /oauth/perform_login until further notice.

Where exactly must the new redirect URI be specified?

The new redirect URI must be specified in the configuration application of your OpenID provider (e.g. Keycloak or Azure Active Directory) for the "DRACOON" application in addition to the current entry.

  1. Sign in to the Keycloak configuration application.
  2. In the navigation pane, click Clients.
  3. In the table of clients, click Edit next to the DRACOON entry.
  4. On the Settings tab, under Valid RedirectURIs, add the new redirect URI /oauth/openid-callback in the empty text box below the existing entries (enter the complete URL including https://), and click the plus button on the right.
    Example:
  1. Sign in to the Azure portal.
  2. In the left navigation bar, click Azure Active Directory.
  3. Click App registrations.
  4. In the table of apps, click the entry for DRACOON.
  5. On the App Overview page, click Authentication.
  6. Under Redirect URIs, add the new redirect URI /oauth/openid-callback in the empty text box below the existing entries (enter the complete URL including https:// etc.),
    Example:

Do settings have to be changed in DRACOON as well?

No, the redirect URI change must only be made in the configuration of the OpenID provider—no configuration changes are required in DRACOON itself.

How can I get help or support?

If you have any questions or need assistance regarding this chance, contact DRACOON support.

Related articles

Comments

0 comments

Article is closed for comments.