Hi,
I wanted to inform you that our microservices are running inside a container and communicate via HTTP. However, the callback URL we provide is formatted as follows:
options.CallbackPath = "/api/oidc/ExternalLoginCallback"
The domain name is automatically picked from the schema settings, resulting in the URL being:
http://{domain}/api/oidc/ExternalLoginCallback
However, the identity provider (IDP) expects the URL to be HTTPS:
https://{domain}/api/oidc/ExternalLoginCallback
Since our microservices are running on HTTP, the schema configuration defaults to the HTTP endpoint. If I forcefully replace HTTP with HTTPS, I encounter a "Correlation failed" error.
You provided a solution, and I would like to know if that will resolve this error, or if we need to implement additional solutions, such as configuring middleware to accept both HTTP and HTTPS requests.
Thank you!
Thanks for update, let me try and get back to you.
Sorry for late reply, I just send logs over email please find.
pls remove above code from chat ; details screen shot have been shared over email, please check.
For me it's loading 
pls check
deployment is in progress. I will ping you once it done.
details have been shared over email, please check.
can you please share your email id, I can share one-to-one with you.
If I don't add the code below, it shows 'Connection Not Secure'., var originalOnRedirectToIdentityProvider = options.Events.OnRedirectToIdentityProvider; options.Events.OnRedirectToIdentityProvider = async context => { var redirectUri = context.ProtocolMessage.RedirectUri; Log.Information($"redirectUri 1: {context.ProtocolMessage.RedirectUri}"); context.ProtocolMessage.RedirectUri = redirectUri.Replace("http://", "https://"); Log.Information($"redirectUri 2: {context.ProtocolMessage.RedirectUri}"); if (string.IsNullOrEmpty(context.ProtocolMessage.Nonce)) { context.ProtocolMessage.Nonce = Guid.NewGuid().ToString(); } if (originalOnRedirectToIdentityProvider != null) { await originalOnRedirectToIdentityProvider(context); } };
options.CorrelationCookie.SameSite = SameSiteMode.None; // Required for cross-site
options.CorrelationCookie.IsEssential = true; // Always send the cookie
options.CorrelationCookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;// Use HTTPS And HTTP
options.CorrelationCookie.HttpOnly = true; // Security measure
If I remove the above code, how should I handle the scenario? Could you please assist me?
Scenario Description :- In our environment, we have a set of microservices running within Docker containers (or Kubernetes), and these microservices communicate with each other over HTTP internally for performance and simplicity reasons. However, for external communication, specifically for handling OpenID Connect (OIDC) authentication callbacks, we need to ensure that HTTPS is used for secure communication, as these external calls require the use of HTTPS (e.g., OIDC authentication or third-party service integrations).
I have included a reference link for your consideration, as I was facing the same issue described there. https://github.com/dotnet/aspnetcore/issues/16924
