Linkedin OAuth2.0 : How to configure OAuth 2.0 Redirect URL with a wildcard subdomain url for a multi tenant application

Question

I am trying to configure a LinkedIn application for a multi tenant site. I will have 20+ tenants using the same application and the number is going to increase every time.

As per Linkedin API documentation (https://developer.linkedin.com/docs/oauth2) we need to ensure following points

1. We strongly recommend using HTTPS whenever possible

2. URLs must be absolute (e.g. "https://example.com/auth/callback", not "/auth/callback")

3. URL arguments are ignored (i.e. https://example.com/?id=1 is the same as https://example.com/)

4. URLs cannot include #'s (i.e. "https://example.com/auth/callback#linkedin" is invalid)

Can i configure redirect url as https://*.mysite.com/auth/linkedin/callback instead of specifying url of each tenant separately.

Garrard

Answer 1

You cannot do a subdomain based wild card mapping as the IP should know the RP.

You can change the logic after you get the authorization callback, so you set the cookie and then you will have to redirect the user back to the tenant URL instead of the base URL.

Anyway, after successful authorization, you will be redirecting the user to an action, just figure out the subdomaina and the construct the URL and do the redirection

HTH

EDIT

Since the use of the URL or other approaches seem to be a hack, can you please try to have a facade like application (or Gateway like one) that has a URL that is registered in linkedin and then on receiving the response, it can use a state or other factor to redirect to the tenant URL. This can use a 302 and it will be invisible unless the user is on a very slow network. This approach does not require any hack like approach.

Here state can be a function that takes a tenant info and generates a dynamic hash that is stored for tracking and redirection.

Flasket

good one but. consider this if your using another domain to receive the 'code', in my case it was a different domain than my login domain in this case localstorage or cookies didn't work i used the state url parameter to send the callback url – Rather

yes, using cookies across different domains do not work due to security issues, Also using an application url in the state still is a security threat, because it is something that becomes static. – Flasket

@Diego, you can try to add some dynamic parameter to the URL, then hash that value and store the original and hash in the origin application, so that when you get back the hash, you can use that to retrieve the URL, again in case of an application behind a load balancer, you should opt to move this to REDIS like central store. Adding an idea to the post – Flasket

@Diego, I have an idea added to the answer, hope that will be a good option than relying on the state . – Flasket