AAD - The redirect URI specified in the request does not match the redirect URIs configured for the application

[Ellismellur]

I recently bought a 10 user license and now I'm setting up Azure Active Directory authentication with Seq.

I am hosting the Seq in a Linux container (latest version from DockerHub) hosted in a web app in Azure (app service). I have made an app registration and followed these instructions https://docs.datalust.co/docs/azure-active-directory

The Seq gives me a read only redirect URI which starts with HTTPS. I copy that URI and paste it into my azure portal (into the app registration created for the Seq) to allow that redirect URI. But when I finally enable the authentication and when I log in using AAD it gives me this error stating that the redirect URI is not on the list over allowed URI's. The weird thing is that the URI starts with HTTP but not HTTPS in the error message, and that is not on the allowed list since it is not possible to allow a HTTP redirect URI in the Azure portal, and therefore I have no way to make this work.

The error:
AADSTS50011: The redirect URI 'http://myhiddendevprojectsurl.azurewebsites.net/aad' specified in the request does not match the redirect URIs configured for the application 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'.

Am I doing something wrong her or is there some kind of a bug?

[nblumhardt]

Hi @Ellismellur, thanks for reaching out.

It looks like you need to set SEQ_API_CANONICALURI to the HTTPS address of your Seq container (https://myhidden...) - the note mentioning it in the linked doc is easy to miss, I'll have a shot at making it clearer. If that's not the case please just let me know.

Unfortunately, Azure App Service isn't a suitable hosting platform for Seq - the App Service runtime allows multiple instances of the container to run concurrently (and the available file systems don't appear to support file locks) so data corruptions are common in this environment.

Azure Container Instances is a very similar Azure offering that we've seen much more success with in the field - some details at: https://docs.datalust.co/docs/using-azure-container-instances-aci

Hope this helps!

Best regards,
Nick

[Ellismellur]

Hi @nblumhardt, thanks for a quick reply.

I did not know about app service not being a suitable hosting platform, but since that is the case I tried following the instructions for container instance, and everything seems to work until I navigate to the newly hosted instance. Then it asks for a username and password. We have tried configuring the SEQ-FIRSTRUN-ADMINPASSWORDHASH but without any luck. Where can I find this username and password that the instance defaults to?

[nblumhardt]

Hi @Ellismellur. The SEQ_FIRSTRUN_* settings are only respected when the data store is completely empty; if you attached the original storage from your App Service deployment, then it will still be using the same authentication settings as were enabled on that platform.

If it's a completely fresh install, deleting the /data/Documents folder and trying to set the SEQ_FIRSTRUN_* settings again could sort it out.

Otherwise, if you can grab the latest file from /data/Logs and send it through to [email protected] we should be able to home in on it.

Hope this helps,
Nick