# OpenID Connect - OAuth 2.0 redirect URI issue **URL:** \ **Category:** Ignition\ **Created:** [August 4, 2020, 7:40pm UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382 "2020-08-04T19:40:21Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![djones](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@djones](https://forum.inductiveautomation.com/u/djones)\ **Post date:** [August 4, 2020, 7:40pm UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/1 "2020-08-04T19:40:21Z")
my company uses google for email and calendars and whatnot. I am attempting to get our development server to use the GSuite OpenID Connect (OAuth2.0) because we have a couple different AD forests. All the AD forests are present in our GSuite. So, if i can create an identity provider with this GSuite connection. I can solve some problems and i’d like to see if perspective will bypass the login screen if the user is already validated in chrome. I’ve got everything setup API Keys, Client IDs no problem and and that all looks good, but i am getting an error from the redirect URI. Invalid Redirect: must end with a public top-level domain (such as .com or .org). When I setup the IdP it says that the redirect URI is: [http://myignitionserver:8088/data/federate/callback/oidc](http://myignitionserver:8088/data/federate/callback/oidc) I cannot quite figure out where to go from here. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [August 4, 2020, 9:42pm UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/2 "2020-08-04T21:42:54Z")
This is likely a security restriction that Google places on the redirect URIs you are allowed to use for your client. They’re probably requiring you to enter a URI whose host name portion contains a valid internet top level domain (and will probably require the protocol to be `https` unless you are using `localhost` or a non-public ip address such as `127.0.0.1` to access your development instance of Ignition from your web browser). You’ll need to set up a valid internet domain name for your Gateway or if its just a handful of you accessing this Gateway, you could each mock this out by editing your local hosts files and point an arbitrary domain name to your Gateway’s IP address. For enabling https, you will need to turn on SSL / TLS in the Gateway, which requires installing an SSL certificate which includes the domain name you will use to access the Gateway. ---
**Author:** ![djones](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@djones](https://forum.inductiveautomation.com/u/djones)\ **Post date:** [August 5, 2020, 12:20am UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/3 "2020-08-05T00:20:16Z")
I tried using 127.0.0.1 and get the same error. I am working with our infrastructure team to get the perspective project redirected to something like [project.mydomain.com](http://project.mydomain.com). I think we need something along the lines of IIS running reverse proxy on the ignition gateway and our DNS servers to redirect those queries to the ignition server, but I am not sure exactly how to do all that. I am trying to explain to my Infrastructure group what I need, but I am certain I am missing some details. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [August 5, 2020, 12:27am UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/4 "2020-08-05T00:27:28Z")
Did you literally enter `127.0.0.1` as the redirect URI? or did you enter `http://127.0.0.1:8088/data/federate/callback/oidc`? I would not expect the former to work but the latter should be accepted by Google (it is for me). ---
**Author:** ![djones](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@djones](https://forum.inductiveautomation.com/u/djones)\ **Post date:** [August 5, 2020, 12:46am UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/5 "2020-08-05T00:46:04Z")
I have put it in from your post and I get ## Error 400: invalid\_request Invalid parameter value for redirect\_uri: Non-public domains not allowed: It shows the error with my servername not the 127.0.0.1 ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [August 5, 2020, 12:49am UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/6 "2020-08-05T00:49:00Z")
In your web browser, are you accessing your Gateway from `http://127.0.0.1`? ---
**Author:** ![djones](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@djones](https://forum.inductiveautomation.com/u/djones)\ **Post date:** [August 5, 2020, 12:52am UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/7 "2020-08-05T00:52:09Z")
No. I realize the mistake, It is a VM server and I am on my laptop. This only works when running locally on the ignition server? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [August 5, 2020, 12:58am UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/8 "2020-08-05T00:58:13Z")
The scheme, host, and port in the redirect URI need to match what is in the URL you use to navigate to the Gateway from your web browser. Google allows you to use `127.0.0.1` and `localhost` as the host portion of the redirect URL since this is common for testing local environments, but if you use some other host name to navigate to your Gateway, then Google will only accept it if it is a fully qualified internet domain name (such as `foo.example.com`). If you do not have a domain set up for your Gateway, you could temporarily edit the hosts file on the computer(s) from which you launch your web browser and mock out a domain name of your choosing and resolve it to the IP of the Gateway you are targeting, but this mocked out domain name will only resolve on the computer(s) with the edited hosts files. ---
**Author:** ![djones](https://avatars.discourse-cdn.com/v4/letter/d/43a26b/32.png) [@djones](https://forum.inductiveautomation.com/u/djones)\ **Post date:** [August 5, 2020, 1:10am UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/9 "2020-08-05T01:10:22Z")
Am I correct that I need my infrastructure team to modify the DNS records to send requests for: [http://www.myproject.mydomain.com/data/perspective/client/myproject](http://www.myproject.mydomain.com/data/perspective/client/myproject) to [http://myignitionserver:8088/data/perspective/client/myproject](http://myignitionserver:8088/data/perspective/client/myproject) and that if i want: [http://www.myproject.mydomain.com](http://www.myproject.mydomain.com) to route to my ignition server then I need to IIS reverse proxy setup on the ignition server? I understand that DNS modifications will send all queries for [http://www.myproject.mydomain.com](http://www.myproject.mydomain.com) to [http://myignitionserver](http://myignitionserver) (or more specifically its IP address), but the reverse proxy needs to handle the port and the rest of the URL Is this correct? ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [August 5, 2020, 4:17pm UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/10 "2020-08-05T16:17:13Z")
It sounds like you are on the right track, though I can’t speak to your specific environment as to whether or not you need a reverse proxy. That really depends on your network architecture. ---
**Author:** ![WillMT10](https://avatars.discourse-cdn.com/v4/letter/w/7feea3/32.png) [@WillMT10](https://forum.inductiveautomation.com/u/WillMT10)\ **Post date:** [October 30, 2020, 11:12pm UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/11 "2020-10-30T23:12:58Z")
@djones were you able to get this working? If so, did you get an answer to this: > [@djones](#): > > i’d like to see if perspective will bypass the login screen if the user is already validated in chrome. ---
**Author:** ![andytimc](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andytimc/32/11938_2.png) [@andytimc](https://forum.inductiveautomation.com/u/andytimc)\ **Post date:** [December 17, 2020, 4:01pm UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/12 "2020-12-17T16:01:01Z")
I think I’m seeing a similar issue I’m getting a bad request error from OKTA when I try a test Logon. The error reads as follows: Description: The ‘redirect\_uri’ parameter must be a Login redirect URI in the client app settings: [https://pennenergyresources-admin.okta.com/admin/app/oidc\_client/instance/0oa6uekiiiBCRPbOZ357#tab-general](https://pennenergyresources-admin.okta.com/admin/app/oidc_client/instance/0oa6uekiiiBCRPbOZ357#tab-general) We set the redirect uri to **[http://10.180.191.48:8088/data/federate/callback/oidc](http://10.180.191.48:8088/data/federate/callback/oidc)** and still see the error. Its a private IP but our OKTA server has access to it. I’m not sure where to go from here we are trying to get our development PC running ignition 8.1 so we can make the change to perspective. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [December 18, 2020, 4:16pm UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/13 "2020-12-18T16:16:20Z")
Are you accessing your perspective project in your web browser using `http://10.180.191.48:8088/`? Assuming you have configured the same redirect URL in your Okta client app’s settings, it should work… ---
**Author:** ![andytimc](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/andytimc/32/11938_2.png) [@andytimc](https://forum.inductiveautomation.com/u/andytimc)\ **Post date:** [December 18, 2020, 5:04pm UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/15 "2020-12-18T17:04:50Z")
Yeah I see the issue, when I was using the Test Login from the browser I was using the localhost:8088 address. When I navigate in the browser to the 10.180.191.48:8088 the Test Logon worked. So when I put this into service if I have a local IP and a public IP will both redirect addresses need added to the identity provider for things to work from a local and public perspective. ---
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [December 18, 2020, 5:05pm UTC](https://forum.inductiveautomation.com/t/openid-connect-oauth-2-0-redirect-uri-issue/37382/16 "2020-12-18T17:05:54Z")
> [@andytimc](#): > > So when I put this into service if I have a local IP and a public IP will both redirect addresses need added to the identity provider for things to work from a local and public perspective. Yes, all URLs which can be used to access the Gateway need to be added to the redirect URLs list at the IdP.