### Summary When setting up GitLab Pages manually without a wildcard DNS record, we always receive a `The redirect URI included is not valid` error during authentication for GitLab Pages behind access restrictions. ### Steps to reproduce We have a self-hosted GitLab instance and would like to add Pages support. However, for our organization it is not possible to get wildcard DNS entries. Since we only need to support a (very) finite list of projects for Pages, we wanted to add DNS A records for Pages manually. This is what we tried: * GitLab instance is at `gitlab.subdomain.example.com` * Pages are to be available on the same server under `pages.subdomain.example.com`, which is a `CNAME` to `gitlab.subdomain.example.com` * Additionally, we have also have `A` records for `projects.pages.subdomain.example.com` and `myproject.pages.subdomain.example.com` pointing to the same server. All Pages URLs are HTTPS-only and the GitLab Pages DNS certificate was issued for all three pertinent domains, i.e., `pages...`, `projects.pages...`, and `myproject.pages...` Accessing `myproject.pages.subdomain.example.com` seems to work at first, and since it is configured to be only available for authenticated users, it redirects to an authentication page. However, then we get shown a ``` An error has occurred The redirect URI included is not valid. ``` error and from there it is not possible (at least for me) to find out what went wrong and where. When we try to test the setup with a different domain for GitLab Pages for which we *can* create wildcard DNS A records, everything works as advertised. However, I still feel like this is unexpected behavior and thus I am filing a bug report. #### Results of GitLab environment info <details> <summary>Expand for output related to GitLab environment info</summary> <pre> System information System: Ubuntu 18.04 Current User: git Using RVM: no Ruby Version: 2.6.5p114 Gem Version: 2.7.10 Bundler Version:1.17.3 Rake Version: 12.3.3 Redis Version: 5.0.7 Git Version: 2.26.2 Sidekiq Version:5.2.7 Go Version: unknown GitLab information Version: 12.10.2 Revision: d90add1c62d Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 11.7 URL: https://gitlab.subdomain.example.com HTTP Clone URL: https://gitlab.subdomain.example.com/some-group/some-project.git SSH Clone URL: git@gitlab.subdomain.example.com:some-group/some-project.git Using LDAP: no Using Omniauth: yes Omniauth Providers: GitLab Shell Version: 12.2.0 Repository storage paths: - default: /mnt/ssd/gitlab/git-data/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git </pre> </details> #### Results of GitLab application Check <details> <summary>Expand for output related to the GitLab application check</summary> <pre> Checking GitLab subtasks ... Checking GitLab Shell ... GitLab Shell: ... GitLab Shell version >= 12.2.0 ? ... OK (12.2.0) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Internal API available: OK Redis available via internal API: OK gitlab-shell self-check successful Checking GitLab Shell ... Finished Checking Gitaly ... Gitaly: ... default ... OK Checking Gitaly ... Finished Checking Sidekiq ... Sidekiq: ... Running? ... yes Number of Sidekiq processes ... 1 Checking Sidekiq ... Finished Checking Incoming Email ... Incoming Email: ... Reply by email is disabled in config/gitlab.yml Checking Incoming Email ... Finished Checking LDAP ... LDAP: ... LDAP is disabled in config/gitlab.yml Checking LDAP ... Finished Checking GitLab App ... Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... 3/1 ... yes 18/2 ... yes 19/3 ... yes 32/4 ... yes 2/5 ... yes 34/13 ... yes 14/16 ... yes 14/17 ... yes 14/18 ... yes 14/19 ... yes 14/20 ... yes 14/21 ... yes 14/22 ... yes 14/23 ... yes 14/24 ... yes 14/25 ... yes 14/26 ... yes 14/27 ... yes 19/28 ... yes 19/29 ... yes 19/30 ... yes 19/31 ... yes 19/32 ... yes 19/33 ... yes 19/34 ... yes 19/35 ... yes 19/36 ... yes 19/37 ... yes 19/38 ... yes 19/39 ... yes 19/40 ... yes 19/41 ... yes 23/43 ... yes 23/44 ... yes 22/45 ... yes 15/46 ... yes 6/48 ... yes 6/49 ... yes 19/50 ... yes 51/51 ... yes 51/52 ... yes 51/53 ... yes 50/54 ... yes 24/55 ... yes 24/56 ... yes 7/57 ... yes 49/58 ... yes 50/59 ... yes 52/61 ... yes 2/62 ... yes 51/64 ... yes 47/65 ... yes 47/66 ... yes 21/67 ... yes 31/68 ... yes 21/69 ... yes 55/70 ... yes 21/71 ... yes 21/72 ... yes 21/73 ... yes 31/74 ... yes 14/75 ... yes 34/76 ... yes 6/77 ... yes 6/78 ... yes 6/79 ... yes 25/80 ... yes 21/81 ... yes 26/82 ... yes 26/83 ... yes 17/84 ... yes 6/85 ... yes 23/86 ... yes 23/87 ... yes 18/89 ... yes 25/90 ... yes 21/91 ... yes 22/92 ... yes 21/93 ... yes 60/94 ... yes 60/95 ... yes 61/96 ... yes 23/97 ... yes 26/98 ... yes 21/100 ... yes 23/102 ... yes 26/104 ... yes 65/106 ... yes 64/107 ... yes 64/108 ... yes 65/109 ... yes 19/110 ... yes 76/111 ... yes 21/112 ... yes 25/113 ... yes 47/114 ... yes 17/115 ... yes 17/116 ... yes 17/117 ... yes 69/118 ... yes 68/119 ... yes 34/121 ... yes 68/122 ... yes 26/123 ... yes 34/124 ... yes 21/125 ... yes 26/126 ... yes 25/127 ... yes 34/128 ... yes 34/129 ... yes 29/130 ... yes 22/131 ... yes 69/132 ... yes 76/134 ... yes 76/135 ... yes 23/137 ... yes 23/138 ... yes 23/139 ... yes 23/142 ... yes Redis version >= 4.0.0? ... yes Ruby version >= 2.5.3 ? ... yes (2.6.5) Git version >= 2.22.0 ? ... yes (2.26.2) Git user has default SSH configuration? ... yes Active users: ... 32 Is authorized keys file accessible? ... yes Checking GitLab App ... Finished Checking GitLab subtasks ... Finished </pre> </details>