diff --git a/api_test.go b/api_test.go
index f57bba824..98a6ba42b 100644
--- a/api_test.go
+++ b/api_test.go
@@ -1491,6 +1491,7 @@ admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"`
 		AuthorizeURL:     "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/authorize",
 		TokenURL:         "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/token",
 		GroupEndpointURL: "https://graph.microsoft.com/v1.0/me/transitiveMemberOf/microsoft.graph.group?$count=true",
+		RedirectBaseURL:  "https://localhost:10101",
 		LogoutURL:        "https://login.microsoftonline.com/common/oauth2/v2.0/logout",
 		Scopes:           []string{"https://graph.microsoft.com/.default", "offline_access"},
 		SecretKey:        "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF",
diff --git a/ctl/server.go b/ctl/server.go
index 74f5ad888..db5300e83 100644
--- a/ctl/server.go
+++ b/ctl/server.go
@@ -111,6 +111,7 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) {
 	flags.StringVar(&srv.Config.Auth.ClientId, "auth.client-id", srv.Config.Auth.ClientId, "Identity Provider's Application/Client ID.")
 	flags.StringVar(&srv.Config.Auth.ClientSecret, "auth.client-secret", srv.Config.Auth.ClientSecret, "Identity Provider's Client Secret.")
 	flags.StringVar(&srv.Config.Auth.AuthorizeURL, "auth.authorize-url", srv.Config.Auth.AuthorizeURL, "Identity Provider's Authorize URL.")
+	flags.StringVar(&srv.Config.Auth.RedirectBaseURL, "auth.redirect-base-url", srv.Config.Auth.RedirectBaseURL, "Base URL of the featurebase instance used to redirect IDP.")
 	flags.StringVar(&srv.Config.Auth.TokenURL, "auth.token-url", srv.Config.Auth.TokenURL, "Identity Provider's Token URL.")
 	flags.StringVar(&srv.Config.Auth.GroupEndpointURL, "auth.group-endpoint-url", srv.Config.Auth.GroupEndpointURL, "Identity Provider's Group endpoint URL.")
 	flags.StringVar(&srv.Config.Auth.LogoutURL, "auth.logout-url", srv.Config.Auth.LogoutURL, "Identity Provider's Logout URL.")
diff --git a/install/featurebase.conf b/install/featurebase.conf
index 3389ff90d..a8894e8f9 100644
--- a/install/featurebase.conf
+++ b/install/featurebase.conf
@@ -381,6 +381,7 @@ log-path = "/var/log/molecula/featurebase.log"
 #  authorize-url = ""
 #  token-url = ""
 #  group-endpoint-url = ""
+#  redirect-base-url = ""
 #  logout-url = ""
 #  scopes = ["", ""]
 #  secret-key = ""
diff --git a/server/config.go b/server/config.go
index e3fe21fe3..fd319aa6a 100644
--- a/server/config.go
+++ b/server/config.go
@@ -240,6 +240,7 @@ type Auth struct {
 	AuthorizeURL     string   `toml:"authorize-url"`
 	TokenURL         string   `toml:"token-url"`
 	GroupEndpointURL string   `toml:"group-endpoint-url"`
+	RedirectBaseURL  string   `toml:"redirect-base-url"`
 	LogoutURL        string   `toml:"logout-url"`
 	Scopes           []string `toml:"scopes"`
 	SecretKey        string   `toml:"secret-key"`
@@ -622,6 +623,7 @@ func (c *Config) ValidateAuth() (errors []error) {
 		{name: "AuthorizeURL", val: c.Auth.AuthorizeURL},
 		{name: "TokenURL", val: c.Auth.TokenURL},
 		{name: "GroupEndpointURL", val: c.Auth.GroupEndpointURL},
+		{name: "RedirectBaseURL", val: c.Auth.RedirectBaseURL},
 		{name: "LogoutURL", val: c.Auth.LogoutURL},
 		{name: "SecretKey", val: c.Auth.SecretKey},
 		{name: "QueryLogPath", val: c.Auth.QueryLogPath},
diff --git a/server/config_internal_test.go b/server/config_internal_test.go
index 0dcf3ffb4..b12b58bff 100644
--- a/server/config_internal_test.go
+++ b/server/config_internal_test.go
@@ -309,12 +309,14 @@ func TestConfig_validateAuth(t *testing.T) {
 				errorMesgEmpty,
 				errorMesgEmpty,
 				errorMesgEmpty,
+				errorMesgEmpty,
 			},
 			Auth{
 				Enable:           enable,
 				ClientId:         emptyString,
 				ClientSecret:     emptyString,
 				AuthorizeURL:     emptyString,
+				RedirectBaseURL:  emptyString,
 				TokenURL:         emptyString,
 				GroupEndpointURL: emptyString,
 				LogoutURL:        emptyString,
@@ -334,6 +336,7 @@ func TestConfig_validateAuth(t *testing.T) {
 				ClientSecret:     validClientSecret,
 				AuthorizeURL:     validTestURL,
 				TokenURL:         validTestURL,
+				RedirectBaseURL:  validTestURL,
 				GroupEndpointURL: validTestURL,
 				LogoutURL:        validTestURL,
 				Scopes:           validStringSlice,
@@ -354,6 +357,7 @@ func TestConfig_validateAuth(t *testing.T) {
 				AuthorizeURL:     validTestURL,
 				TokenURL:         invalidURL,
 				GroupEndpointURL: invalidURL,
+				RedirectBaseURL:  validTestURL,
 				LogoutURL:        invalidURL,
 				Scopes:           validStringSlice,
 				SecretKey:        validKey,
@@ -372,6 +376,7 @@ func TestConfig_validateAuth(t *testing.T) {
 				AuthorizeURL:     validTestURL,
 				TokenURL:         validTestURL,
 				GroupEndpointURL: validTestURL,
+				RedirectBaseURL:  validTestURL,
 				LogoutURL:        validTestURL,
 				Scopes:           emptySlice,
 				SecretKey:        validKey,
@@ -387,6 +392,7 @@ func TestConfig_validateAuth(t *testing.T) {
 				ClientSecret:     validClientSecret,
 				AuthorizeURL:     validTestURL,
 				TokenURL:         validTestURL,
+				RedirectBaseURL:  validTestURL,
 				GroupEndpointURL: validTestURL,
 				LogoutURL:        validTestURL,
 				Scopes:           validStringSlice,
@@ -402,6 +408,7 @@ func TestConfig_validateAuth(t *testing.T) {
 				ClientId:         emptyString,
 				ClientSecret:     validString,
 				AuthorizeURL:     emptyString,
+				RedirectBaseURL:  validTestURL,
 				TokenURL:         emptyString,
 				GroupEndpointURL: invalidURL,
 				LogoutURL:        validTestURL,
diff --git a/server/server.go b/server/server.go
index 781a1a216..0d38c8c78 100644
--- a/server/server.go
+++ b/server/server.go
@@ -538,7 +538,7 @@ func (m *Command) SetupServer() error {
 		}
 
 		ac := m.Config.Auth
-		m.auth, err = authn.NewAuth(m.logger, m.listenURI.String(), ac.Scopes, ac.AuthorizeURL, ac.TokenURL, ac.GroupEndpointURL, ac.LogoutURL, ac.ClientId, ac.ClientSecret, ac.SecretKey)
+		m.auth, err = authn.NewAuth(m.logger, ac.RedirectBaseURL, ac.Scopes, ac.AuthorizeURL, ac.TokenURL, ac.GroupEndpointURL, ac.LogoutURL, ac.ClientId, ac.ClientSecret, ac.SecretKey)
 		if err != nil {
 			return errors.Wrap(err, "instantiating authN object")
 		}