I have auth setup and I understand that /.auth/* is supposed to handle both the outbound and the inbound callback. However, I get a 401 on return for https://preview.nkdagility.com/.auth/login/aad/callback To Reproduce Steps to reproduce the behaviour: Go to https://preview.nkdagility.com/.auth/login/aad/ Login Return to https://preview.nkdagility.com/.auth/login/aad/callback 401: Unauthorized URLs Site: https://preview.nkdagility.com Build: https://github.com/nkdAgility/NKDAgility.com/blob/main/.github/workflows/main.yaml staticwebapp.config.json: https://github.com/nkdAgility/NKDAgility.com/blob/main/staticwebapp.config.json GitRepo: https://github.com/nkdAgility/NKDAgility.com/ Expected behavior I expected this to be handled and return to site with auth tokens present. Any help would be appreciated.

`/.auth/login/aad/callback` fails with 401 after sucessfull login

Martin Hinshelwood nkdAgility.com 35 MVP

I have auth setup and I understand that /.auth/* is supposed to handle both the outbound and the inbound callback. However, I get a 401 on return for https://preview.nkdagility.com/.auth/login/aad/callback

To Reproduce

Steps to reproduce the behaviour:

Go to https://preview.nkdagility.com/.auth/login/aad/
Login
Return to https://preview.nkdagility.com/.auth/login/aad/callback
401: Unauthorized

URLs

Site: https://preview.nkdagility.com

Build: https://github.com/nkdAgility/NKDAgility.com/blob/main/.github/workflows/main.yaml

staticwebapp.config.json: https://github.com/nkdAgility/NKDAgility.com/blob/main/staticwebapp.config.json

GitRepo: https://github.com/nkdAgility/NKDAgility.com/

Expected behavior

I expected this to be handled and return to site with auth tokens present.

Any help would be appreciated.

Martin Hinshelwood nkdAgility.com 35 Reputation points MVP

2024-11-01T13:19:21.1766667+00:00

Not a duplicate of https://learn.microsoft.com/en-us/answers/questions/2114301/deploying-the-api-succeds-on-build-but-no-api-is-p?comment=question! These are two undrealted and seperate issues that both happen to exist on the same instace. Do not merge them!
Laxman Reddy Revuri 1,035 Reputation points Microsoft Vendor

2024-11-01T13:26:40.5833333+00:00

Hi @Martin Hinshelwood nkdAgility.com
Thanks for the question and using MS Q&A platform.
We are currently looking into this and will get back to you soon.
Martin Hinshelwood nkdAgility.com 35 Reputation points MVP

2024-11-01T18:35:37.9566667+00:00

Thanks. I've varified that GitHub Auth works, but AAD not

Laxman Reddy Revuri 1,035 Microsoft Vendor

Hi @Martin Hinshelwood nkdAgility.com
Apologies for the delayed response.

Staticwebapp.config.json: https://github.com/nkdAgility/NKDAgility.com/blob/main/staticwebapp.config.json
Add the following code

{    
 "routes": [   
  {    
   "route": "/",   
  "serve": "/",     
  "statusCode": 200,       
"allowedRoles": ["authenticated"] 
    },    
 {       
"route": "/api/*",      
 "allowedRoles": ["authenticated"]    
 },    
 {      
 "route": "/login",      
 "rewrite": "/.auth/login/aad" 
    },    
 {       
"route": "/logout",      
 "redirect": "/.auth/logout"    
   }  
 ], 
  "responseOverrides": {     
"401": {       
"redirect": "/login",      
 "statusCode": 302    
 }  
 },   "auth": {  
 "identityProviders": {      
 "azureActiveDirectory": {        
 "registration": {         
  "openIdIssuer": "https://login.microsoftonline.com/658f988bf-86f1-41af-91ab-2d7cd011db47/v2.0",       
   "clientIdSettingName": "AAD_CLIENT_ID",          
 "clientSecretSettingName": "AAD_CLIENT_SECRET"                
      }           
     }          
    }     
   }  
  }

In the code OpenID Issuer :https://login.microsoftonline.com/(write your Tenant ID)/v2.0,

For more information about routing policies:
https://learn.microsoft.com/en-us/azure/static-web-apps/configuration

I hope this information is helpful.

Martin Hinshelwood nkdAgility.com 35 Reputation points MVP

2024-11-05T09:16:08.6466667+00:00
If returning to /.auth/login/aad/callback results in a 401 then that implies that the correct tokens are not being passed back from aad? No?

Also please note that your code had the wrong claim authority! I'm using ciamlogin and not microsoftonline! I'm authenticating with "Entra ID for External"...

The routes above really does not make sense as the GitHub auth works without any routes, and the redirects you list above do not address the /.auth/login/aad/callback issue at all.

{ "route": "/login", "rewrite": "/.auth/login/aad" }, { "route": "/logout", "redirect": "/.auth/logout" }

These two routs are not aplicable as I do not want to only support AAD.

{ "route": "/api/*", "allowedRoles": ["authenticated"] },

This /api/ route is invalid as I do not want the /api/* to be authenticated.

{ "route": "/", "serve": "/", "statusCode": 200, "allowedRoles": ["authenticated"] }

And you are going to have to explain what this does as it looks to be re-aserting a default.
Martin Hinshelwood nkdAgility.com 35 Reputation points MVP

2024-11-05T09:26:37.4766667+00:00

DELETED
Laxman Reddy Revuri 1,035 Reputation points Microsoft Vendor

2024-11-05T10:01:58.4766667+00:00

Hi @Martin Hinshelwood nkdAgility.com
we have reached out to you over private message could you please check and help us with requested information to assist you further.

Share via

`/.auth/login/aad/callback` fails with 401 after sucessfull login

Your answer