elsa-workflows/elsa-core · error · OpenIdConnectAuthenticationException

The deployment callback base URI is not configured.

Error message

The deployment callback base URI is not configured.

What it means

GetCallbackUri computes the redirect_uri for the authorization (and token) request from options.Value.Redirects.ExternalCallbackBaseUri. When that option is null, the adapter cannot construct a callback and throws immediately. This is a deployment-level configuration error, independent of any identity-provider connection.

Solutions

1. Set Redirects:ExternalCallbackBaseUri in configuration to the deployment's externally reachable base URL.
2. Verify the options binding (Elsa OpenIdConnect options section) is registered and the key name matches exactly.
3. Confirm the value is an absolute URI (scheme + host), not a relative path.
4. Add a startup validation step that fails fast when the option is absent rather than at first login.

Example fix

// before (appsettings.json)
{ }
// after
{ "Elsa": { "OpenIdConnect": { "Redirects": { "ExternalCallbackBaseUri": "https://myapp.example.com" } } } }

var redirects = options.Value.Redirects;
if (Uri.TryCreate(redirects.ExternalCallbackBaseUri?.ToString(), UriKind.Absolute, out _))
    logger.LogInformation("External callback base URI: {Uri}", redirects.ExternalCallbackBaseUri);
else
    throw new InvalidOperationException("Redirects.ExternalCallbackBaseUri must be set to an absolute URI before external authentication is used.");

try { await broker.HandleCallbackAsync(...); }
catch (OpenIdConnectAuthenticationException ex) when (ex.Message.Contains("callback base URI"))
{ logger.LogCritical(ex, "Deployment misconfiguration: ExternalCallbackBaseUri not set"); return Results.Problem("Authentication is not configured for this deployment.", statusCode: 503); }

When it happens

Trigger: GetCallbackUri is invoked (authorize redirect construction or token exchange) while the OpenIdConnect options' Redirects.ExternalCallbackBaseUri has not been set in app configuration.

Common situations: Missing Elsa OpenIdConnect Redirects section in appsettings.json for a given environment; reverse proxy deployments where the externally visible base URL was never configured; config key renamed or bound to the wrong options section; local dev worked (default inferred) but staging lacks it.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• The OpenID Connect connection configuration is invalid.
• The OpenID Connect discovery URL is required.
• The provider client secret is unavailable.
• The identity provider did not provide signing keys.
• OpenID Connect settings must be an object.

AI-assisted analysis of elsa-workflows/elsa-core@fe9217bdfa (2026-09-13). Data as JSON: /api/errors/e9a155677f5dd56f. Report an issue: GitHub.

Appendix: source

Thrown at src/modules/Elsa.ExternalAuthentication.OpenIdConnect/Services/OpenIdConnectExternalAuthenticationAdapter.cs:216

            ValidAudience = settings.ClientId,
            ValidateIssuerSigningKey = true,
            IssuerSigningKeys = signingKeys,
            RequireSignedTokens = true,
            ValidateLifetime = true,
            ClockSkew = TimeSpan.FromMinutes(1)
        });
        if (!validation.IsValid || validation.ClaimsIdentity is null)
            throw new OpenIdConnectAuthenticationException("The identity provider ID token was invalid.");

        var audiences = validation.ClaimsIdentity.FindAll("aud").Select(x => x.Value).Distinct(StringComparer.Ordinal).ToArray();
        if (audiences.Length > 1 && !string.Equals(validation.ClaimsIdentity.FindFirst("azp")?.Value, settings.ClientId, StringComparison.Ordinal))
            throw new OpenIdConnectAuthenticationException("The identity provider ID token was not authorized for this client.");
        return new(validation.ClaimsIdentity);
    }

    private Uri GetCallbackUri(EffectiveIdentityProviderConnection connection, BrokerTransactionPurpose purpose)
    {
        var baseUri = options.Value.Redirects.ExternalCallbackBaseUri ?? throw new OpenIdConnectAuthenticationException("The deployment callback base URI is not configured.");
        return ExternalAuthenticationCallbackUris.GetAuthorizationCallbackUri(baseUri, connection.Connection, purpose);
    }

    private Uri GetLogoutCallbackUri(EffectiveIdentityProviderConnection connection)
    {
        var baseUri = options.Value.Redirects.ExternalCallbackBaseUri ?? throw new OpenIdConnectAuthenticationException("The deployment callback base URI is not configured.");
        return ExternalAuthenticationCallbackUris.GetLogoutCallbackUri(baseUri, connection.Connection.Key);
    }

    private async Task<IEnumerable<SecurityKey>> GetSigningKeysAsync(Uri? jwksUri, CancellationToken cancellationToken)
    {
        if (jwksUri is null)
            throw new OpenIdConnectAuthenticationException("The identity provider did not provide signing keys.");
        var response = await providerHttpClient.GetAsync(jwksUri, ProviderResponseKind.SigningKeys, cancellationToken);
        if (!response.IsSuccessStatusCode)
            throw new OpenIdConnectAuthenticationException("The identity provider signing keys could not be resolved.");
        try
        {

View on GitHub (pinned to fe9217bdfa)