Check whether the OAuth2 redirect URI for mint.tacc.utexas.edu is already registered #73

Activity

1. mosoriob

   added

   wayfinder:taskWayfinder ticket: manual work that unblocks a decisionWayfinder ticket: manual work that unblocks a decision

   on Aug 8, 2026
2. mosoriob

   marked this as blocking on Aug 8, 2026

   • Settle the window.__MINT_CONFIG__ values for the TACC deployment #75
3. mosoriob

   added a parent issue on Aug 8, 2026

   • Wayfinder: close out the SUBSIDE UI SOW — TACC signs off on ui-react at mint.tacc.utexas.edu #79
4. mosoriob

   self-assigned this

   on Aug 8, 2026
5. mosoriob commented on Aug 8, 2026

   

   mosoriob

   on Aug 8, 2026

   Last edited by mosoriob

   ContributorAuthor

   More actions

   Answer

   The redirect URI is registered already. No work is necessary at the identity provider.
   ui-react uses the same OAuth2 client as ui.

   The ticket expected a different callback path for ui. That expectation was wrong. Both apps
   use the browser origin plus /oauth2/callback. See mint-ui-lit/src/util/oauth2-adapter.ts:56.

   1. What is registered

   The identity provider is Tapis, tenant portals. It is not Keycloak.

   The OAuth2 client is mint. The ui app uses this client today. Its registered
   callback_url is exactly:

   https://mint.tacc.utexas.edu/oauth2/callback
   

   ui-react sends the same URL from that host. Source:
   https://mint.tacc.utexas.edu/config.js.

   How I proved this

   Tapis compares the redirect_uri on GET /v3/oauth2/authorize. It does this before the login
   page. Thus a test needs no password. Tests on 2026-08-08:

   client_id	redirect_uri	Result
   mint	https://mint.tacc.utexas.edu/oauth2/callback	302 to login — match
   mint	https://mint.tacc.utexas.edu/nope/callback	400 — no match
   mint	http://mint.tacc.utexas.edu/oauth2/callback	400 — no match

   The last two rows are important. They show that the test is accurate. Tapis compares the
   scheme, the host and the path.

   I also tested mint-vercel, mint-local and four possible React client names. Each MINT client
   has one origin. No React client exists.

   2. One callback URL for each client

   This is correct. A Tapis client has one callback_url field. See the
   Tapis documentation.

   But #70 made a wrong conclusion from this fact. ui_react does not need its own client:

   1. Both apps send the same URL. There is no second URL to add.
   2. Only one app has a route at the host at one time. Flip mint.tacc.utexas.edu to ui-react #77 keeps ui deployed with no route.

   Decision: ui-react uses the client mint. Thus the cutover and the rollback need no
   change at Tapis.

   Warning: the chart disagrees

   charts/mint/values.yaml and the fail in templates/ui-react-config.yaml say that ui_react
   must use a different client. That text is not correct for this cutover. It assumes two different
   origins. The template stops only if client_id is empty. The value mint is permitted.

   Effects on other tickets

   • Settle the window.__MINT_CONFIG__ values for the TACC deployment #75 — set ui_react.config.client_id: "mint" and auth_callback_origin: "".
   • Flip mint.tacc.utexas.edu to ui-react #77 — the host must be exactly https://mint.tacc.utexas.edu. Also, keep ui deployed
     with no route. Do not move ui to a second host. There it cannot log in, because its callback
     URL comes from the browser origin and has no override.
   • Do not use a temporary host for ui-react before the cutover. A temporary host needs its own
     client.

   The container serves the callback path correctly. docker/nginx.conf uses
   try_files $uri /index.html.
6. mosoriob

   closed this as completedon Aug 8, 2026