Coder.com•14mo ago•

7 replies

Need different OIDC redirect URL from the `CODER_ACCESS_URL`

Continuation of my intro here

The reason for this being I have two ways for users to access my environment. One is a direct domain (internal network --

foo.internal

foo.internal

) and the other is an MFA authentication enforced domain (external network --

foo.external

foo.external

). Only authenticated users can traverse

foo.external

foo.external

. This prohibits workspaces and the other Coder services because they cannot authenticate. As a result I must set the

CODER_ACCESS_URL

CODER_ACCESS_URL

value to

foo.internal

foo.internal

. I'd also like users to be able to come in on

foo.external

foo.external

. The issue here being when a user tries to log in via OIDC, the redirect URL is set to

CODER_ACCESS_URL

CODER_ACCESS_URL

(which is

foo.internal

foo.internal

in this situation), not the desired incoming domain of

foo.external

foo.external

. This leads to a

State mismatched

State mismatched

error when the user is redirected back to

foo.internal/api/v2/users/oidc/callback...

foo.internal/api/v2/users/oidc/callback...

, despite coming in on

foo.external

foo.external

.

I see two potential solutions:
1. Being able to enable something like

OIDC_DYNAMIC_REDIRECT

OIDC_DYNAMIC_REDIRECT

which would use the incoming domain as the redirect URL. This would fix my issue and allow for users to come in on both

foo.internal

foo.internal

and

foo.external

foo.external

.
2. Being able to set

OIDC_REDIRECT_URL

OIDC_REDIRECT_URL

so I could choose, per-deployment, if I need a different redirect URL than

CODER_ACCESS_URL

CODER_ACCESS_URL

. Going this route, I could fix the

foo.external

foo.external

route (which is the far more important path in my deployment) and OIDC login would be broken for

foo.internal

foo.internal

.

I've looked through all the docs and I haven't found any that address this issue. I'm not opposed to modifying the source code to put in some custom logic, but I am struggling to track down exactly where

CODER_ACCESS_URL

CODER_ACCESS_URL

gets passed to the OIDC client configuration. I would greatly appreciate any feedback, input, or even a hint as to which file I should dig through.

Thanks!

Coder.com•14mo ago•

7 replies

Runawaytrain

Need different OIDC redirect URL from the `CODER_ACCESS_URL`

Continuation of my intro here

The reason for this being I have two ways for users to access my environment. One is a direct domain (internal network --

foo.internal

foo.internal

) and the other is an MFA authentication enforced domain (external network --

foo.external

foo.external

). Only authenticated users can traverse

foo.external

foo.external

. This prohibits workspaces and the other Coder services because they cannot authenticate. As a result I must set the

CODER_ACCESS_URL

CODER_ACCESS_URL

value to

foo.internal

foo.internal

. I'd also like users to be able to come in on

foo.external

foo.external

. The issue here being when a user tries to log in via OIDC, the redirect URL is set to

CODER_ACCESS_URL

CODER_ACCESS_URL

(which is

foo.internal

foo.internal

in this situation), not the desired incoming domain of

foo.external

foo.external

. This leads to a

State mismatched

State mismatched

error when the user is redirected back to

foo.internal/api/v2/users/oidc/callback...

foo.internal/api/v2/users/oidc/callback...

, despite coming in on

foo.external

foo.external

.

I see two potential solutions:
1. Being able to enable something like

OIDC_DYNAMIC_REDIRECT

OIDC_DYNAMIC_REDIRECT

which would use the incoming domain as the redirect URL. This would fix my issue and allow for users to come in on both

foo.internal

foo.internal

and

foo.external

foo.external

.
2. Being able to set

OIDC_REDIRECT_URL

OIDC_REDIRECT_URL

so I could choose, per-deployment, if I need a different redirect URL than

CODER_ACCESS_URL

CODER_ACCESS_URL

. Going this route, I could fix the

foo.external

foo.external

route (which is the far more important path in my deployment) and OIDC login would be broken for

foo.internal

foo.internal

CODER_ACCESS_URL

CODER_ACCESS_URL

gets passed to the OIDC client configuration. I would greatly appreciate any feedback, input, or even a hint as to which file I should dig through.

Thanks!

Need different OIDC redirect URL from the `CODER_ACCESS_URL`

Need different OIDC redirect URL from the `CODER_ACCESS_URL`

Similar Threads

Similar Threads

Similar Threads