Jira incoming OAuth2 invalid redirect_uri

[Marc Jacobi]

Hi, I am new to Jira and new to OAuth2 so.... yeah. ;-)

I am trying to implement OAuth2 for Jira in a DevOps extension (authorization code flow).
The devops extension FE runs inside an IFrame in the DevOps site (not sure if that is relevant). I am using '@badgateway/oauth2-client' as a client JS/TS library.

For testing I am running Jira in a Docker image (no https, only http) locally as well as the extension code locally in VScode.

I have created an application link in Jira with the callback url I created to pickup the authorization code and fetch the access token from jira. I copied the resulting client id and secret for use in the extension.

When I call the jira /authorize endpoint with the necessary query string params I get an error from the Jira server (tomcat) on the (plugin) consent page.

HTTP Status 412 – Precondition Failed

---

Type Status Report

Message Invalid 'redirect_uri' URL parameter provided

Description One or more conditions given in the request header fields evaluated to false when tested on the server.

---

Apache Tomcat/9.0.83

This is the url (localhost:8080=docker):

http://localhost:8080/plugins/servlet/oauth2/consent
?client_id=<app link client id>
&redirect_uri=https://dev.azure.com/<org>/<project>/_apps/hub/<extension>.<location>
&response_type=code
&scope=WRITE
&state=<my state>
&code_challenge_method=S256
&code_challenge=<generated challenge code>

No matter what I try with the redirect_url, I keep getting errors.

There is probably something obvious I am doing wrong, but I am not seeing it.
Thanks in advance.

[Ignacio Aredez GenAI Expert]

Redirect URI Issues
The "Invalid 'redirect_uri' URL parameter provided" error typically indicates a mismatch or configuration issue between the Redirect URI you've specified in your OAuth2 request and the one registered in your Jira application link or OAuth2 app configuration. Here are a few things to consider:

Exact Match Requirement: Ensure the Redirect URI in your OAuth2 request exactly matches one of the Redirect URIs registered in your Jira application link settings. This includes the protocol (https://), domain, port (if specified), path, and absence or presence of trailing slashes.

Base URL Configuration: Since you've adjusted the base URL of your Jira site, double-check that the Redirect URI reflects this change accurately. Any discrepancy between the base URL and the Redirect URI can cause issues.

ngrok URL Stability: If you're using ngrok's free tier, the URL changes every time you restart ngrok, requiring you to update the Redirect URI in your Jira application link settings accordingly. Consider using a paid ngrok plan for a stable, reusable URL or another method to secure a consistent domain for development purposes.

CORS Policy
While CORS policy is crucial for client-side interactions, it typically doesn't impact the Redirect URI validation in OAuth2 flows since the initial authorization request and redirect are handled server-side. However, ensuring your devops domain is in the allow-list is a good practice for other aspects of integration that involve client-side requests.

Unauthorized (401) Error
The unauthorized error when calling the /authorize URL might have been due to a temporary misconfiguration or an issue with the OAuth2 credentials (client ID/secret) or tokens. Since you mentioned this was a quirk and you're back to the original Redirect URI error, it's less likely to be related to CORS directly and more about the OAuth2 configuration and Redirect URI validation.

Steps Forward
Review OAuth2 Configuration: Double-check your OAuth2 app configuration in Jira, ensuring that the Redirect URI(s) are correctly set and match your ngrok URL exactly.
Consistency Check: Verify that the Redirect URI used in your OAuth2 authorization request is identical to the one in your Jira settings, considering any changes made to the base URL or ngrok setup.

Debugging Tips: Use tools like Postman or a similar HTTP client to manually craft and test the OAuth2 authorization request. This can help isolate the issue by removing variables related to your development environment.

If these steps don't resolve the "Invalid 'redirect_uri' URL parameter provided" error, consider revisiting the OAuth2 app configuration in Jira and any documentation specific to the OAuth2 integration process to ensure all settings align with Jira's requirements and your development setup.

And if I help you in any way and you give me a like I appreciate it.

[Marc Jacobi]

"Base URL Configuration: Since you've adjusted the base URL of your Jira site, double-check that the Redirect URI reflects this change accurately. Any discrepancy between the base URL and the Redirect URI can cause issues."

This suggests that the redirect url has the same base as the JIra server url!?
My redirect url is in the dev.azure.com domain. How can I perform authorization code to access token handling when the redirect is to Jira!?

[Marc Jacobi]

I think it has to do with the spaces in my url.
When I replace the spaces with '+' it works (Jira login and consent) up until navigating to my redirect_url.

Problem is I cannot find any combination that seems to work. Url encode, not url encode, encode twice. It all fails. I can also not enter spaces in the redirect url field in the application link. I have to escape my spaces there (%20)... :-(

If there was only a way to discover what is expected.

I also got Postman to work with its own callback url.

[Ignacio Aredez GenAI Expert]

URL Encoding for Spaces: Use %20 to encode spaces in URLs. This encoding applies both to the Redirect URI in your code and the one configured in Jira's application link settings.

Exact Match Requirement: Ensure the encoded Redirect URI in your OAuth2 authorization request matches exactly with the one in Jira, including the encoding of spaces as %20.

Incremental Testing: Start with a simple Redirect URI without spaces and verify it works. Then, introduce encoded spaces (%20) to identify at which point issues arise.

[Marc Jacobi]

Yeah - that is exactly what I did.

Introducing the encoded spaces (%20) seems to make it fail.

[Ignacio Aredez GenAI Expert]

To resolve the Invalid 'redirect_uri' error in your OAuth2 setup for Jira, consider the following simplified steps:

Redirect URI Mismatch: Ensure the redirect_uri in your OAuth2 request exactly matches the callback URL registered in Jira's application link settings. This includes matching the protocol (HTTP vs HTTPS), domain, port, and path precisely.

URL Encoding: Verify the redirect_uri is correctly URL-encoded, especially if it contains special characters or spaces.

IFrame Considerations: Be aware that running OAuth2 flows inside an IFrame may face additional security restrictions. Check for cross-origin issues and browser security policies that could affect the process.

Jira Callback URL Configuration: Double-check that the callback URL configured in Jira matches the redirect_uri used in your request. Ensure the correct setup for different environments (local, staging, production).

Debugging Tips:

Inspect Jira's logs for more specific error details.
Test the OAuth2 authorization URL directly in a browser, bypassing the IFrame, to see if the issue persists.
Simplify the redirect_uri for testing purposes to a basic endpoint to determine if the error is related to the URI's complexity or setup.

These steps should help identify and resolve the issues with your OAuth2 integration in Jira.

[Marc Jacobi]

Redirect URI Configuration/Mismatch: I have tried different urls in an effort to discover what would be considered (in)valid and copied-pasted between the Jira Application Link and the url I report in the code. I have tried with and without url encoding.  I currently work with only one environment (local).

IFrame: I use the devops client sdk to navigate at top level, outside of the IFrame. I have tried, in-place navigate, new tab and popup. This does not affect the result for the redirect_url. Navigating inside the IFrame gives a browser warning-page I do not want my users to see ;-). 

Cross Origin: Do I need to configure allowed sites in the Jira server? Where can I do that?

Logs: Where can I find these logs?

Https/SSL: I found an article that states that the Jira server itself has to run Https/SSL in order for OAuth2 to work (makes sense). I am now trying to find out how to configure my docker image to use SSL (never done that before). Let me know if this is dead end or I could be on to something?

[Ignacio Aredez GenAI Expert]

Redirect URI Configuration/Mismatch: Ensure the Redirect URI in your Jira Application Link exactly matches the one in your code, including the scheme, domain, port, and path. URL encoding should be correct when initiating OAuth2 flows.

IFrame Navigation: Use the DevOps client SDK for top-level navigation to avoid cross-origin issues and browser warnings associated with IFrames.

Cross-Origin Requests: For CORS policy, manually configure allowed sites in Jira Server or Data Center settings or refer to Atlassian documentation for Jira Cloud.

Logs: Find logs in the log directory of your Jira application home, typically atlassian-jira.log for application logs.

Https/SSL Requirement: HTTPS is mandatory for OAuth2 security. Configure SSL for your local Docker environment by generating a self-signed SSL certificate, mounting it in the Docker container, and configuring the web server to use HTTPS. Alternatively, use a reverse proxy for SSL termination.

Moving Forward: Transition your local development to use HTTPS to align with OAuth2 security requirements and ensure all parts of your pipeline are configured for HTTPS.

[Marc Jacobi]

I have SSL configured using ngrok and the Jira site works again over https.
I did have to edit the server.xml a bit and set a new base url for the jira site. Seems fine now.

I noticed that when I specify a redirect_uri that is the jira site itself, the redirect is taken. So that leads me to belief that it probably has to do with the CORS policy.

I have added the devops domain to the allow-list but now I get an unauthorized (401) on calling the /authorize url...?

We're not there yet.

[Marc Jacobi]

Even with the AllowList turned off (allow all) it doesn't work...

That Authorized-error was a quirk - we're back to the original error: "Invalid 'redirect_uri' URL parameter provided" (412)

[Ignacio Aredez GenAI Expert]

The "Invalid 'redirect_uri' URL parameter provided" error typically means there's a mismatch between the Redirect URI in your OAuth2 request and what's registered in Jira. Here's a condensed action plan:

Exact Match: Ensure the Redirect URI in your request matches exactly with what's registered in Jira, including protocol, domain, path, and trailing slashes.

Check Base URL: After adjusting Jira's base URL, make sure the Redirect URI reflects these changes accurately.

ngrok URL Stability: If using ngrok's free tier, remember the URL changes with each restart. Update the Redirect URI in Jira accordingly, or consider a stable solution.

Review OAuth2 Configuration: Double-check your OAuth2 app settings in Jira, ensuring the Redirect URI(s) are correctly configured.

Test Manually: Use tools like Postman to manually test the OAuth2 authorization request, isolating the issue from your development environment.

Adjust your OAuth2 configuration as needed, ensuring consistency between your request and Jira's settings.

If it helps you in any way, don't forget to like the replies, it helps me. Thank you very much and I hope this works for you