Unable to access Foglight due to "Invalid Redirect URI" error (4378119)

When attempting to log in, the error message "Invalid redirect URI" is displayed.

This issue occurs only when accessing via the Angular UI (/aui) and Foglight is behind a proxy or load balancer; the Classic Console (/console) is not affected.

The following message is present in the Foglight Management Server (FMS) logs:

WARN    [http-exec-4] com.quest.foglight.auth.util.ServletUtils - isValidRedirect suspect as vulnerable redirect=https://foglight.yourdomain.com/aui/auth

When debug logging is enabled, the following message is included in the logs:

DEBUG [http-exec-2] com.quest.foglight.auth.util.ServletUtils - ServletUtils::isValidRedirect url=http://foglight.yourdomain.com/login/page uri=/login/page redirect=https://foglight.yourdomain/aui/auth address=http://foglight.yourdomain.com

This may happen due to security enhancements introduced in Foglight 7.3.0 (FOG-9149), which affect certain proxy or load balancer configurations.

It can occur when a client connects to the proxy via HTTPS, while the proxy or load balancer connects to Foglight over HTTP and the "X-Forwarded-Proto" header is not included to identify the protocol the client used to connect to the proxy or load balancer.

WORKAROUND 1 (recommended)

Review the proxy or load balancer configuration to ensure it includes the "X-Forwarded-Proto" header to identify the client's connection protocol (HTTPS).

Note: The configuration steps may vary depending on the proxy or load balancer in use. Consult system administrators for configuration guidance.

WORKAROUND 2

Change the default value of the of registry variable "oauth.cors.allowed.origins" to the one of the URL used to access Foglight:

1. Go to the Administration > Rules & Notifications > Manage Registry Variable dashboard.
2. Search for the variable "oauth.cors.allowed.origins" and click to edit.
3. Change the value to the URL used to access without the trailing slash or port; for example "https://foglight.yourdomain.com".

Note: Updating the registry variable to a specific URL would allow the validation to pass and for that URL to be the single allowed origin.