Portal auto-adds machine name / FQDN to a custom OAuth2 app's redirect URIs weeks after registration

AustinG

**Environment**
- ArcGIS Enterprise (Portal) version:11.X
- Single machine / HA: Single
- Web Adaptor: yes

I registered a custom OAuth2 application programmatically (ArcGIS API for Python `registerApp`). The redirect URIs are supplied from a config file, and that config does NOT contain the portal machine name or the public FQDN. Immediately after registration, the app's redirect_uris are exactly what I specified (no machine name, no FQDN).

Weeks later, without the registration script running again, two extra redirect URIs have appeared in the app:
- the portal's internal machine name (e.g. https://gisserver01.internal)
- the public FQDN (e.g. https://portal.example.com)

I remove them (as admin), and after some time they come back.

**What I've already checked / ruled out**
- The Python registration script has NOT run since the initial registration.
- The redirect URIs are 100% not in the script/config.
- Portal logs at DEBUG level show no updateAppInfo / registerApp / redirect-related entries around the time they reappear.
- The app's owner is a now-disabled account, so nothing can be authenticating and editing as the owner.
- This only happens to THIS one custom app. Other OAuth2 apps in the same portal do not get URIs re-added.

**My question**
What mechanism in Portal re-injects its own machine name / FQDN into a custom app's redirect_uris after the fact? Is this expected behavior tied to portal service restart, upgrade, reindex? Is there any way to prevent it, or is removing them post-restart the only option? And does the disabled owner account matter here?

If anyone from Esri can point to documentation or a KB article on why the FQDN/machine name is added to redirect URIs by default, that would be hugely helpful. I haven't been able to find anything official describing this.

Thanks!

JeffreySutherland

Hi Austin,

This is expected, albeit undocumented behavior that occurs whenever you restart the Portal for ArcGIS system service. It is part of internal logic for registered applications, primarily intended to support the auto-addition of local redirect URIs for Esri web applications hosted within Portal for ArcGIS (ex: ArcGIS Dashboards) or custom web applications hosted on the same web server as Portal for ArcGIS or the corresponding web adaptor.

There is a sneaky workaround that should prevent this behavior, though it does involve adding another redirect URI to your custom registered app. Simply specify/add the redirect urn:ietf:wg:oauth:2.0:oob to your custom application at registration time. The presence of this redirect URI should prevent the FQDN and machine names from being added as redirect URIs whenever the Portal for ArcGIS system service is restarted.

Let me know if the above workaround satisfies your needs. I would also be curious if the behavior you've described is causing any specific issues or problems with your custom application. 

Thanks,

Jeff