SSO NAA Outlook Add-in Error in Production Environment

Question

SSO NAA Outlook Add-in Error in Production Environment

Omer Erez 20

I am experiencing an issue with the SSO NAA Outlook Add-in in the production environment. The setup works correctly in the development environment, but in production, it returns the following error when attempting to send the SSO to the 'token' endpoint:

{ 
  "error": "invalid_client", 
  "error_description": "AADSTS700046: Invalid Reply Address. Reply Address must have scheme brk-9199bf20-a13f-4107-85dc-02114787ef48:// and be of Single Page Application type. Trace ID: 38d9c6e8-2324-4ca1-9390-266c4ca13000 Correlation ID: 68b5af08-7e23-4d86-99ab-9f45dee1385b Timestamp: 2024-12-12 00:51:38Z", 
  "error_codes": [ 700046 ], 
  "timestamp": "2024-12-12 00:51:38Z", 
  "trace_id": "38d9c6e8-2324-4ca1-9390-266c4ca13000", 
  "correlation_id": "68b5af08-7e23-4d86-99ab-9f45dee1385b" 
}

What steps are necessary to resolve this issue, specifically regarding the required URIs to ensure functionality in production? The instructions and setup worked without issues in development.

Referencing the GitHub repository for context: Outlook Add-in SSO NAA Sample.

ChristyZhang-MSFT 26,226 Reputation points Microsoft External Staff

2024-12-12T07:17:17.46+00:00

Hi @Omer Erez ,

Welcome to our forum!

Looks like your issue is more related to add-in development, please kindly understand that the Outlook tag here we mainly focus on general issues about Outlook desktop client. In order to better solve your problem, we will add "Office Development" tag.

Answer accepted by question author

0 additional answers

Your answer

ChristyZhang-MSFT 26,226 Reputation points Microsoft External Staff

2024-12-12T07:17:17.46+00:00

Hi @Omer Erez ,

Welcome to our forum!

Looks like your issue is more related to add-in development, please kindly understand that the Outlook tag here we mainly focus on general issues about Outlook desktop client. In order to better solve your problem, we will add "Office Development" tag.

Answer 1

David Chesnut 241 Microsoft Employee

Hi Omer, Have you updated the brk-multihub://localhost:3000 SPA redirect in your app registration to reflect the production domain URI?

Thanks!

David

Omer Erez 20 Reputation points

2024-12-14T17:57:59.77+00:00
Hi David! Hope you are doing well!

Thanks for replying.

Should all the DEV URIs be removed?

https://localhost:3000/dialog.html

https://localhost:3000/auth.html

brk-multihub://localhost:3000

(The main purpose is to use the same Azure app for both DEV and PROD)

Is it fine? Or perhaps it is the thing causing the issue?

My URIs that I have set are as follows:

https://prod.example.net/addin/prod/dialog.html

https://prod.example.net/addin/prod/auth.html

brk-multihub://prod.example.net/addin/prod

https://localhost:3000/dialog.html

https://localhost:3000/auth.html

brk-multihub://localhost:3000

Just to clarify, this URI:

brk-multihub://prod.example.net/addin/prod

Points to the folder which contains the content of the 'dist' folder which you generate by running the 'npm run build' command.

Is this URI proper? Should all the DEV URIs be removed?

Is this problem can be fixed by refining the URIs alone?

I can say that I made some tests with adding <WebApplicationInfo> to the manifest file, essentially modifying the manifest to try to fix the issue, but all of these trials have concluded with having an invalid manifest which caused failed installation of the add-in.

It basically looks something like this:

<WebApplicationInfo> <Id>Azure-App-ID</Id> <Resource>api://Azure-App-ID</Resource> <Scopes>openid profile offline_access Mail.ReadWrite</Scopes> <BrokerRedirectUri>brk-9199bf20-a13f-4107-85dc-02114787ef48://prod.example.net/addin/prod/auth.html</BrokerRedirectUri> </WebApplicationInfo>

And one last note, the App API permissions:

Mail.ReadWrite, offline_access, openid, profile, User.Read

Admin consent has been approved for all (of course)

And under 'Authentication':

URIs (as specified above)

Front-channel logout URL - left empty

Implicit grant and hybrid flows - left empty (nothing is checked)

Supported account types - set to 'Multitenant'

Advanced settings | Allow public client flows - set to 'No'

App instance property lock - left unchanged (default)

Thanks!!
Omer Erez 20 Reputation points

2024-12-14T17:59:58.37+00:00

Thanks again for replying.

If you can help me understand the nuance, I would be grateful.

Thanks!
David Chesnut 241 Reputation points Microsoft Employee

2024-12-17T14:48:21.1266667+00:00

Having multiple brk-multihub entries is fine. I think you just want to use "brk-multihub://prod.example.net" to point to your domain. The WebApplicationInfo in the XML manifest is more for supporting the getAccessToken Office.js API (which is not NAA) so that won't affect the error you are seeing.
Omer Erez 20 Reputation points

2024-12-19T11:38:09.95+00:00

Yes, having the URI set like you said (brk-multihub://prod.example.net) fixed the error indeed. Thanks !
David Chesnut 241 Reputation points Microsoft Employee

2024-12-19T23:22:59.0733333+00:00

Nice! I updated the docs with examples to make that more obvious.