Does the "KeyCloak" configuration section in appsettings.json support multiple redirect URLs?

Yes. Note: the name of the section “KeyCloak” is somewhat misleading – it is actually a generic OpenID Connect login configuration, which can be used not only with Keycloak, but also with other identity providers, e.g. Azure AD / Microsoft Entra ID. The “RedirectUri” value can be specified as a list of URLs separated by a semicolon (“;”), e.g.:

Code

{ "KeyCloak": { "RedirectUri": "https://app1.example.com/signin-oidc;https://app2.example.com/signin-oidc" } }

Question: How does the application choose the correct URL if several are specified? When redirecting to the identity provider (Keycloak, Azure AD, etc.), the application compares the domain (host) of the current request with the domain of each URL in the list and uses the one whose host matches.

Question: What happens if the current domain does not match any of the allowed URLs? The application throws an exception stating that the given host does not have an allowed redirect in the KeyCloak/RedirectUri section of appsettings.json. The login will not proceed until the administrator adds the domain to the list.

Question: Do I also need to register this address with the identity provider itself? Yes. All redirect URLs listed in appsettings.json must also be registered as allowed redirect URIs directly in the client configuration of the respective identity provider (Keycloak, Azure AD, etc.), otherwise the login will be rejected regardless of the application’s settings.

Question: What happens if only one URL is specified? If there is only one address in the configuration, it is always used directly, without comparing the domain.