AD Redirect Url does not accept query parameters and gives mismatch error at login

Question

Hi

I know this has been asked a lot, but I couldn't find an answer to my specific case in the docs or forums.

I get the error of AADSTS50011 (Redirect Uri mismatch) when signing in to my app. I compare the two, the only mismatch is that the url that's being used in the app contains a Url parameter (eg. https://example.com?provider=microsoft).

The strange thing is that this error only appears in the case of an organization account, but when I use a personal account, the same redirect url above just works.

Is it something that I can control in Active Directory? Whether to accept query parameters in the redirect url or not?
Is there a way to make this work without removing the url parameters?

Here are the troubleshooting details:

Request Id: 4940f37c-d680-47fa-a024-cad9fb243600
Correlation Id: 3c494b9a-9d79-4ccf-a7f9-8524c7f60b9b
Timestamp: 2022-03-21T08:21:29Z

Thanks

Answer 1

Why you need query string? Normally you should use state instead. Even it works, I guess the query string will be lost after redirect.

Answer 2

We have the exact same issue with the Microsoft Identity middleware. As always with Microsoft libraries, they always give problems because they are never build with abstraction in mind.
For us the login type can be Google, MS, AzureAd etc. We need to know which one was used and looking at the URL referer or something is bad practice.
Using a Session to store this info is also not going to work for us in the sign-out process since we might use a global signed-out app redirecting to the original app you where visiting.
URL parameters are of utmost importance and they are being ignored.