{"record":{"id":"e9a155677f5dd56f","repo":"elsa-workflows/elsa-core","slug":"the-deployment-callback-base-uri-is-not-configured","errorCode":null,"errorMessage":"The deployment callback base URI is not configured.","messagePattern":"The deployment callback base URI is not configured\\.","errorType":"exception","errorClass":"OpenIdConnectAuthenticationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.ExternalAuthentication.OpenIdConnect/Services/OpenIdConnectExternalAuthenticationAdapter.cs","lineNumber":216,"sourceCode":"            ValidAudience = settings.ClientId,\n            ValidateIssuerSigningKey = true,\n            IssuerSigningKeys = signingKeys,\n            RequireSignedTokens = true,\n            ValidateLifetime = true,\n            ClockSkew = TimeSpan.FromMinutes(1)\n        });\n        if (!validation.IsValid || validation.ClaimsIdentity is null)\n            throw new OpenIdConnectAuthenticationException(\"The identity provider ID token was invalid.\");\n\n        var audiences = validation.ClaimsIdentity.FindAll(\"aud\").Select(x => x.Value).Distinct(StringComparer.Ordinal).ToArray();\n        if (audiences.Length > 1 && !string.Equals(validation.ClaimsIdentity.FindFirst(\"azp\")?.Value, settings.ClientId, StringComparison.Ordinal))\n            throw new OpenIdConnectAuthenticationException(\"The identity provider ID token was not authorized for this client.\");\n        return new(validation.ClaimsIdentity);\n    }\n\n    private Uri GetCallbackUri(EffectiveIdentityProviderConnection connection, BrokerTransactionPurpose purpose)\n    {\n        var baseUri = options.Value.Redirects.ExternalCallbackBaseUri ?? throw new OpenIdConnectAuthenticationException(\"The deployment callback base URI is not configured.\");\n        return ExternalAuthenticationCallbackUris.GetAuthorizationCallbackUri(baseUri, connection.Connection, purpose);\n    }\n\n    private Uri GetLogoutCallbackUri(EffectiveIdentityProviderConnection connection)\n    {\n        var baseUri = options.Value.Redirects.ExternalCallbackBaseUri ?? throw new OpenIdConnectAuthenticationException(\"The deployment callback base URI is not configured.\");\n        return ExternalAuthenticationCallbackUris.GetLogoutCallbackUri(baseUri, connection.Connection.Key);\n    }\n\n    private async Task<IEnumerable<SecurityKey>> GetSigningKeysAsync(Uri? jwksUri, CancellationToken cancellationToken)\n    {\n        if (jwksUri is null)\n            throw new OpenIdConnectAuthenticationException(\"The identity provider did not provide signing keys.\");\n        var response = await providerHttpClient.GetAsync(jwksUri, ProviderResponseKind.SigningKeys, cancellationToken);\n        if (!response.IsSuccessStatusCode)\n            throw new OpenIdConnectAuthenticationException(\"The identity provider signing keys could not be resolved.\");\n        try\n        {","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.ExternalAuthentication.OpenIdConnect/Services/OpenIdConnectExternalAuthenticationAdapter.cs#L198-L234","documentation":"GetCallbackUri computes the redirect_uri for the authorization (and token) request from options.Value.Redirects.ExternalCallbackBaseUri. When that option is null, the adapter cannot construct a callback and throws immediately. This is a deployment-level configuration error, independent of any identity-provider connection.","triggerScenarios":"GetCallbackUri is invoked (authorize redirect construction or token exchange) while the OpenIdConnect options' Redirects.ExternalCallbackBaseUri has not been set in app configuration.","commonSituations":"Missing Elsa OpenIdConnect Redirects section in appsettings.json for a given environment; reverse proxy deployments where the externally visible base URL was never configured; config key renamed or bound to the wrong options section; local dev worked (default inferred) but staging lacks it.","solutions":["Set Redirects:ExternalCallbackBaseUri in configuration to the deployment's externally reachable base URL.","Verify the options binding (Elsa OpenIdConnect options section) is registered and the key name matches exactly.","Confirm the value is an absolute URI (scheme + host), not a relative path.","Add a startup validation step that fails fast when the option is absent rather than at first login."],"exampleFix":"// before (appsettings.json)\n{ }\n// after\n{ \"Elsa\": { \"OpenIdConnect\": { \"Redirects\": { \"ExternalCallbackBaseUri\": \"https://myapp.example.com\" } } } }","handlingStrategy":"validation","validationCode":"var redirects = options.Value.Redirects;\nif (Uri.TryCreate(redirects.ExternalCallbackBaseUri?.ToString(), UriKind.Absolute, out _))\n    logger.LogInformation(\"External callback base URI: {Uri}\", redirects.ExternalCallbackBaseUri);\nelse\n    throw new InvalidOperationException(\"Redirects.ExternalCallbackBaseUri must be set to an absolute URI before external authentication is used.\");","typeGuard":null,"tryCatchPattern":"try { await broker.HandleCallbackAsync(...); }\ncatch (OpenIdConnectAuthenticationException ex) when (ex.Message.Contains(\"callback base URI\"))\n{ logger.LogCritical(ex, \"Deployment misconfiguration: ExternalCallbackBaseUri not set\"); return Results.Problem(\"Authentication is not configured for this deployment.\", statusCode: 503); }","preventionTips":["Set Redirects:ExternalCallbackBaseUri in every environment's appsettings/environment variables","Validate the option at startup when the external authentication feature is enabled","Use the exact externally visible base URL (behind proxies, use the public host)"],"tags":["configuration","openid-connect","redirect-uri","deployment"],"backgroundTag":"missing-required-config-field","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}