Azure-sdk-for-java: Spring Boot B2C example redirects /home to /login on localhost; never goes anywhere on VM Tomcat9

[saragluna]

Creating the issue https://github.com/microsoft/azure-spring-boot/issues/940 in this repo @gbsmith

---

Local OS: MacOS Catalina
VM OS: Ubuntu 20.04
VM app server: Tomcat9

Have already setup B2C tenant with JWT.ms and integrated Google Login.

Testing B2C with Spring as per https://docs.microsoft.com/en-us/azure/developer/java/spring-framework/configure-spring-boot-starter-java-app-with-azure-active-directory-b2c-oidc.

When running directly from MacOS localhost command-line, B2C login works and I can see claim details on /home page (actually / loading /home). Then I can successfully click on to /greeting. But when I click back to /home, I get redirected to /login?error. A subsequent attempt to return to /greeting fails authn.

When I moved the WAR package to Tomcat9 running on an Azure VM in our VPN (https://10.40.0.5:8443/b2cdemo), the login page comes up, I am sent to AADB2C to login and then... right back to login, do not go to /home, do not collect $200. Attempts to go directly to /greeting also go nowhere. So what do I need to do to make this work in a real Tomcat deployment?

I am using all the versions cited in the Azure tutorial. The Tomcat is running under Azul OpenJDK 11.

Any ideas?

---

Log extracts attached:

https://github.com/microsoft/azure-spring-boot/files/5718565/b2cdemo_logs.zip

[saragluna]

@gbsmith below is the response from @wujack778

---

Hey @gbsmith , Maybe you can change reply-url from http://localhost:8080/home to http://localhost:8080/Except-home in Azure and yml.
But I am not clear the environment of your tomcat, so try the solution above?

[lzc-1997-abel]

Hi @gbsmith
The reply-url value cannot be the same as the url configured in the Controller. As @wujack778 said, You can configure the reply-url to be anything different from the controller, and configure the Redirect URIs in the portal to the same URL.

In addition, I just added the corresponding certificate configuration in yml and configured the certificate in tomcat, then it works.
The following is the certificate configuration I added in yml.

server:
    port: 8443
    servlet:
        session:
            cookie:
                secure: true
    ssl:
        key-store: keystore.p12
        key-store-password: password
        key-store-type: PKCS12
        key-alias: testCert
        key-password: password

[gbsmith]

Thanks for the replies. Sorry to be late responding, but I had to put this aside and work on other stuff.

So is it just me or is the tutorial at https://docs.microsoft.com/en-us/azure/developer/java/spring-framework/configure-spring-boot-starter-java-app-with-azure-active-directory-b2c-oidc wrong? The way I interpret it, it is saying the reply URL can be in the controller. Is there something in there I misread?

[wujack778]

Yes, our document has an error on the reply-url . Maybe you can modify the reply-url like @lzc-1997-abel and @wujack778 said.@gbsmith

[gbsmith]

Updated to the latest demo code and was able to get demo app working both on localhost and on a VM at ROOT URL like https://tomcat.example.com:9443/login.

However, what do I need to do to make it work deployed under webapps, e.g., webapps/b2cdemo with a URL like https://tomcat.example.com:9443/b2cdemo/login rather than ROOT? I get this in the logs in that case:

2021-01-29 00:43:26.795 DEBUG 37257 --- [nio-9443-exec-3] o.s.security.web.FilterChainProxy        : /login/oauth2/code?state=X9ty...v2o%3d&code=eyJraWQ..._0Rs30gWsg at position 7 of 15 in additional filter chain; firing Filter: 'OAuth2LoginAuthenticationFilter'
2021-01-29 00:43:26.795 DEBUG 37257 --- [nio-9443-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login/oauth2/code'; against '/b2cdemo/login/oauth2/code'

with the filters looking for that /b2cdemo part in the context. Is there some additional conf to make this work?

[lzc-1997-abel]

Hi,@gbsmith,
You can try to configure the reply-url and Redirect URIs on the portal to the path after adding b2cdemo, like https://tomcat.example.com:9443/b2cdemo/login/oauth2/code

[gbsmith]

@lzc-1997-abel , those filter issues already were with the URIs set to include /b2cdemo in the path.

[saragluna]

@gbsmith this is because the loginProcessingUrl is misconfigured with the servlet context path, we're trying to fix it.

https://github.com/Azure/azure-sdk-for-java/blob/683102d169186831717de0c020d329a420552df4/sdk/spring/azure-spring-boot/src/main/java/com/azure/spring/autoconfigure/b2c/AADB2CProperties.java#L99

[msftbot[bot]]

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!