Linkedin OAuth2.0 : How to configure OAuth 2.0 Redirect URL with a wildcard subdomain url for a multi tenant application

Question

I am trying to configure a LinkedIn application for a multi tenant site. I will have 20+ tenants using the same application and the number is going to increase every time.

As per Linkedin API documentation (https://developer.linkedin.com/docs/oauth2) we need to ensure following points

1. We strongly recommend using HTTPS whenever possible

2. URLs must be absolute (e.g. "https://example.com/auth/callback", not "/auth/callback")

3. URL arguments are ignored (i.e. https://example.com/?id=1 is the same as https://example.com/)

4. URLs cannot include #'s (i.e. "https://example.com/auth/callback#linkedin" is invalid)

Can i configure redirect url as https://*.mysite.com/auth/linkedin/callback instead of specifying url of each tenant separately.

Answer 1

You cannot do a subdomain based wild card mapping as the IP should know the RP.

You can change the logic after you get the authorization callback, so you set the cookie and then you will have to redirect the user back to the tenant URL instead of the base URL.

Anyway, after successful authorization, you will be redirecting the user to an action, just figure out the subdomaina and the construct the URL and do the redirection

HTH

EDIT

Since the use of the URL or other approaches seem to be a hack, can you please try to have a facade like application (or Gateway like one) that has a URL that is registered in linkedin and then on receiving the response, it can use a state or other factor to redirect to the tenant URL. This can use a 302 and it will be invisible unless the user is on a very slow network. This approach does not require any hack like approach.

Here state can be a function that takes a tenant info and generates a dynamic hash that is stored for tracking and redirection.