ABP Tiered Behind Application Gateway or Load Balancer #1986

6 Answer(s)

• 

  0

  gterdem created 3 years ago

  Senior .NET Developer

  To clarify, do you want to deploy all your applications (Http.Api.Host, Web and IdentityServer) to same domain with sub folders? Web is running on: mydomain Http.Api.Host on: mydomain.com/api IdentityServer on: mydomain.com/account

  If so, you will need to write Rewrite rule in load balancer (nginx i suppose) to redirect to /account

  You can check deployment configurations docs. Also official identityserver4 deployment docs.

  If you have already deployed identityserver, you can also share its link.

  Save Cancel
• 

  0

  cfd000 created 3 years ago

  To clarify, do you want to deploy all your applications (Http.Api.Host, Web and IdentityServer) to same domain with sub folders? Web is running on: mydomain Http.Api.Host on: mydomain.com/api IdentityServer on: mydomain.com/account

  If so, you will need to write Rewrite rule in load balancer (nginx i suppose) to redirect to /account

  You can check deployment configurations docs. Also official identityserver4 deployment docs.

  If you have already deployed identityserver, you can also share its link.

  Correct. I have the rules configured and working, but the interactions aren't correct.

  For RemoteServices__Default__BaseUrl I am using the internal name of the HTTP-API service. For AuthServer__Authority I cannot use the internal name because the redirect to the login page does not work externally. When I put the FQDN of the Identity-Server (with /Account at the end), and click the Login button, I am redirected to my url.com/?handler=Login which does not load.

  1. Should the Identity server external URL be configured for AuthServer__Authority?
  2. How do I get the Login button to redirect to url.com/Account/Login (or, is there another way to get that redirection to work properly behind the load balancer?)

  Save Cancel
• 

  0

  cfd000 created 3 years ago

  UPDATE

  I was able to get Idenity Server working better by modifying the Startup.cs: public void Configure(IApplicationBuilder app) { app.UseStaticFiles("/IdentityServer"); app.UsePathBase("/IdentityServer"); app.InitializeApplication(); }

  and modifying the ...Module.cs to include (ABOVE the app.UseIdentityServer(); line!):

              var forwardOptions = new ForwardedHeadersOptions
              {
                  ForwardedHeaders = Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedFor | Microsoft.AspNetCore.HttpOverrides.ForwardedHeaders.XForwardedProto,
                  RequireHeaderSymmetry = false
              };
  
              forwardOptions.KnownNetworks.Clear();
              forwardOptions.KnownProxies.Clear();
  
              // ref: https://github.com/aspnet/Docs/issues/2384
              app.UseForwardedHeaders(forwardOptions);
  
  

  This allows the LOGIN button to redirect to the Identity login page. Now if I go directly to the /IdentityServer/ URL (which redirects me to /IdentityServer/Account/Login), I can login successfully. The problem is:

  If I go to the MVC Index page and click the Login button the Request URL header has this:

  https://url.com/IdentityServer/connect/authorize?client_id=ABPWeb_Web&redirect_uri=http://url.com/signin-oidc&response_type=code id_token&scope=openid
  

  When this happens, the /IdentityServer/Account/Login page redirects to a 500 error page with a message "Invalid redirect_uri"

  Where does the redirect_uri come from? I am running HTTPS up to the load balancer, and HTTP behind it.

  Save Cancel
• 

  0

  gterdem created 3 years ago

  Senior .NET Developer

  Redirect_uri's are declared when client is created. See https://support.abp.io/QA/Questions/1951/500-Internal-Server-Error-Invalid-redirecturi#answer-99adb092-2a26-5dbb-6bac-39ff6bc7b817

  Save Cancel
• 

  0

  cfd000 created 3 years ago

  It turns out that the problem was that it is necessary to put the ForwardedHeadersOptions code into EACH PROJECT, simply adding it to IdentityServer is not enough. In hindisght this makes sense, as the MVC project is what generates the headers with the redirect URL in them.

  Save Cancel
• 

  0

  alper created 3 years ago

  Support Team Director

  closing the issue. you can reopen anytime.

  Save Cancel