Hello , 

I wanted to confirm something about the way redirect uris are matched between what is sent in the request  and what is registered on the OIDC provider. 
My understanding is that it needs to be an exact string match - so  if query parameters are added in the request but not registered with the OP , this is going to fail .

 eg if https://abc.com/test is registered on the OP provider , then a request with https://abc.com/test?name=testuser will fail .

am I right? Or will the fact that the base URL stays the same help and it will allow it through for some reason? I am reading that some OIDC implementations are not that strict and wanted to check what IBM's implementation would do

Hi,

I assume you are talking about OIDC on ISVA.

Here the redirect_uri is validated on a prefix base.

So your example would pass, but even an URL https://abc.com/test/myCallback would also pass.

Yes , thank you , I was talking about OIDC on ISVA .I guess my understanding was incorrect then - I thought the full uri needed to match.

Hello,

Well this is right for current version of ISVA.  In the Oauth 2.1 the exact match will be forced. see here https://oauth.net/2.1/.

Actually I don't know in what version will be this Oauth2.1 used / forced in IBM ISVA. 

Maybe IBMers ,can share some more information about it.

Regards,

Hi Janos,

We do recommend that redirect_uri is an exact matche to be OAuth2.0 Security Best Practice compliant, but we do not enforce it since we need to support legacy configuration.