ABP 10 Upgrade - OpenId wildcareDomain #10680

7 Answer(s)

• 

  0

  AI-Bot created 4 months ago

  Support Team ABP Agent

  • In ABP 10, you should not add signin-oidc / signout-callback-oidc variants into WildcardDomainsFormat. WildcardDomainsFormat expects site root URL formats, not callback endpoints.
  • Use a wildcard domain format without the trailing slash, and only for the host part, e.g.:

  "App": {
    "OpenIddictWildcardDomainsFormat": "https://{0}.<app-domain>"
  }
  

  • Configure it like this (only add the root format):

  using Volo.Abp.OpenIddict.WildcardDomains;
  
  if (!hostingEnvironment.IsDevelopment() &&
      !string.IsNullOrWhiteSpace(configuration["App:OpenIddictWildcardDomainsFormat"]))
  {
      PreConfigure<AbpOpenIddictWildcardDomainOptions>(options =>
      {
          options.EnableWildcardDomainSupport = true;
          options.WildcardDomainsFormat.Add(configuration["App:OpenIddictWildcardDomainsFormat"]!);
      });
  }
  

  • After deploying, ensure the AuthServer/OpenIddict client redirect URIs that are seeded/created are consistent with your public URLs (scheme/host). If you are behind an ingress/reverse proxy, also ensure forwarded headers are configured so the generated redirect URLs use https and the public host (otherwise you can end up with mismatched redirect/callback URLs causing 404/redirect issues in tenant subdomains).

  Links:

  • https://abp.io/docs/latest/guides/ms-multi-tenant-domain-resolving
  • https://abp.io/docs/10.4/guides/ms-multi-tenant-domain-resolving

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  DominaTang created 4 months ago

  I am using ABP 10.1.1

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  AI-Bot created 4 months ago

  Support Team ABP Agent

  • ABP 10.1.1 still uses AbpOpenIddictWildcardDomainOptions the same way: WildcardDomainsFormat must contain only the domain/root format, not callback paths.
  • In other words, remove these lines (they can cause mismatches after upgrade because ABP/OpenIddict compares and expands URIs based on the “root format” you give it):
    • ... + "signin-oidc"
    • ... + "signout-callback-oidc"

  Use this configuration instead:

  using Volo.Abp.OpenIddict.WildcardDomains;
  
  if (!hostingEnvironment.IsDevelopment() &&
      !string.IsNullOrWhiteSpace(configuration["App:OpenIddictWildcardDomainsFormat"]))
  {
      PreConfigure<AbpOpenIddictWildcardDomainOptions>(options =>
      {
          options.EnableWildcardDomainSupport = true;
          options.WildcardDomainsFormat.Add(configuration["App:OpenIddictWildcardDomainsFormat"]!);
      });
  }
  

  And set the value without a trailing slash:

  "App": {
    "OpenIddictWildcardDomainsFormat": "https://{0}.<app-domain>"
  }
  

  Also (common after moving to AKS/ingress): ensure your apps read the correct external scheme/host; otherwise OpenIddict may generate/validate redirect URIs against the wrong scheme/host. In AKS, configure forwarded headers / ingress so the app sees https and the real public host.

  Sources:

  • https://abp.io/docs/10.1/guides/ms-multi-tenant-domain-resolving
  • https://abp.io/docs/latest/guides/ms-multi-tenant-domain-resolving
  • https://abp.io/docs/latest/framework/architecture/multi-tenancy/index#domain-subdomain-tenant-resolver

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  DominaTang created 4 months ago

  Let me clarify this way, we have another project which is currently with ABP 9, both projects doesn't follow ABP's multi-tenant document page.

  Project A (ABP 8 -> ABP 10 in progress): implemented in this way.

  1. In Auth Server , it has this code: In PreConfigureServices() method: //Configurate Wild Card Domain options for OpenIddict only on non-local environments if (!hostingEnvironment.IsDevelopment() && !string.IsNullOrWhiteSpace(configuration["App:OpenIddictWildcardDomainsFormat"])) { PreConfigure<AbpOpenIddictWildcardDomainOptions>(options => { options.EnableWildcardDomainSupport = true; //options.WildcardDomainsFormat.Add("https://{0}.ess:4200/"); options.WildcardDomainsFormat.Add(configuration["App:OpenIddictWildcardDomainsFormat"]); options.WildcardDomainsFormat.Add($@"{configuration["App:OpenIddictWildcardDomainsFormat"]}signin-oidc"); options.WildcardDomainsFormat.Add($@"{configuration["App:OpenIddictWildcardDomainsFormat"]}signout-callback-oidc"); }); } In ConfigServices method, it call resolver bolow:

  private void ConfigureTenantResolver(IWebHostEnvironment hostingEnvironment, IConfiguration configuration) { if (hostingEnvironment.IsDevelopment() || string.IsNullOrWhiteSpace(configuration["App:AuthDomainTenantResolverFormat"])) { Configure<AbpTenantResolveOptions>(options => { options.TenantResolvers.Clear(); options.TenantResolvers.Add(new HeaderTenantResolveContributor()); options.TenantResolvers.Add(new QueryStringTenantResolveContributor()); options.TenantResolvers.Add(new CookieTenantResolveContributor()); options.TenantResolvers.Add(new CurrentUserTenantResolveContributor()); //resolve tenant based on current user's tenant }); } else //Non-Development environments, use sub-domain tenant resolver { Configure<AbpTenantResolveOptions>(options => {

  		options.AddDomainTenantResolver(configuration["App:AuthDomainTenantResolverFormat"]);
  	});
  
  	Configure<OpenIddictServerOptions>(options =>
  	{
  		options.TokenValidationParameters.IssuerValidator = TokenWildcardIssuerValidator.IssuerValidator;
  		options.TokenValidationParameters.ValidIssuers = new[]
  		{
  			configuration["AuthServer:Authority"],
  			$@"{configuration["App:AuthDomainTenantResolverFormat"] }/"
  		};
  	});
  }
  

  }

  2. In gateway it has this code: private void ConfigureTenantResolver(IWebHostEnvironment hostingEnvironment, IConfiguration configuration) { if (hostingEnvironment.IsDevelopment() || string.IsNullOrWhiteSpace(configuration["App:ApiDomainTenantResolverFormat"])) { Configure<AbpTenantResolveOptions>(options => { options.TenantResolvers.Clear(); options.TenantResolvers.Add(new HeaderTenantResolveContributor()); options.TenantResolvers.Add(new CookieTenantResolveContributor()); options.TenantResolvers.Add(new CurrentUserTenantResolveContributor()); }); } else { Configure<AbpTenantResolveOptions>(options => { options.AddDomainTenantResolver(configuration["App:ApiDomainTenantResolverFormat"]); }); } }

  Project B (ABP 9) No matter which environment, it only uses this code in Gateway:

  private void ConfigureTenantResolver() { Configure<AbpTenantResolveOptions>(options => { options.TenantResolvers.Clear(); options.TenantResolvers.Add(new HeaderTenantResolveContributor()); options.TenantResolvers.Add(new CookieTenantResolveContributor()); options.TenantResolvers.Add(new CurrentUserTenantResolveContributor()); //resolve tenant based on current user's tenant }); }

  Now, it's project A has issue after upgrade to ABP 10: When with these two lines, angular will give a bad gateway exception options.WildcardDomainsFormat.Add($@"{configuration["App:OpenIddictWildcardDomainsFormat"]}signin-oidc"); options.WildcardDomainsFormat.Add($@"{configuration["App:OpenIddictWildcardDomainsFormat"]}signout-callback-oidc");

  When remove these two lines, it gives after login and try to navigate to angular site:

  Please note, our Angular App is deployed to azure storage, AI says ABP's muti-tenant document page also need to be deployed to AKS.

  ABP 9's OpenIdDict is version 6, ABP 10 is OpenIdDirect is 7. Also our CI/CD team did some AKS ingress upgrade. These are the difference between the two projects.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 4 months ago

  Support Team Fullstack Developer

  Hi,

  Both errors you see look like they are coming from the infrastructure layer, not from ABP/OpenIddict:

  • The 502 Bad Gateway is most likely returned by the AKS ingress, not by ABP. You mentioned the CI/CD team did an ingress upgrade — that lines up well with the timing.
  • The 404 WebContentNotFound is the Azure Blob Storage static-website error page. The browser request to https://<tenant1>.<app-domain> is reaching Azure Storage directly, but Storage static-website hosting can only bind one custom domain per storage account — it does not natively support wildcard tenant subdomains. So once the browser lands on <tenant1>.<app-domain>, Storage has no idea what to serve.

  That also matches Project B (ABP 9): it does not use domain-based tenant resolution, so its Angular URL stays on a single fixed host and Storage is fine.

  About the two extra WildcardDomainsFormat entries

  You can drop them — in ABP 10 the wildcard match only compares scheme / host / port, so the signin-oidc / signout-callback-oidc entries are no-ops. They are not the cause of the 502 either; removing them just cleans the code up:

  PreConfigure<AbpOpenIddictWildcardDomainOptions>(options =>
  {
      options.EnableWildcardDomainSupport = true;
      options.WildcardDomainsFormat.Add(configuration["App:OpenIddictWildcardDomainsFormat"]);
  });
  

  "App": {
    "OpenIddictWildcardDomainsFormat": "https://{0}.<app-domain>"
  }
  

  Your AuthServer setup (AddDomainTenantResolver + TokenWildcardIssuerValidator + ValidIssuers) is still the correct pattern for ABP 10 — no change needed there.

  What to actually fix

  1. Get the AKS ingress checked first. The recent upgrade is the most likely trigger for the 502. Verify the wildcard TLS cert binding, the host routing rule for *.<app-domain>, upstream service selectors, and that X-Forwarded-Host / X-Forwarded-Proto are still being forwarded.
  2. Put Azure Front Door (or Azure CDN) in front of the Storage account. Storage on its own cannot serve a wildcard tenant URL — Front Door can match *.<app-domain> and forward to your Storage static-website endpoint, so every tenant subdomain resolves to the same Angular SPA.

  If Front Door is off the table, the practical fallback is the same pattern Project B uses — Header / Cookie / CurrentUser resolvers — so the Angular SPA stays on one fixed host.

  To help us pin it down

  Could you send over:

  1. A browser DevTools Network tab capture of a failing login. The response headers will show whether the 502 / 404 is coming from the ingress, from Storage, or somewhere else.
  2. AuthServer verbose logs with OpenIddict turned up. Just add this to your Serilog config temporarily:

  .MinimumLevel.Override("OpenIddict", LogEventLevel.Verbose)
  .MinimumLevel.Override("Microsoft.IdentityModel", LogEventLevel.Verbose)
  

  3. How <tenant1>.<app-domain> is currently bound — Storage custom domain, Front Door, CDN, or a plain DNS CNAME.

  With those we can confirm exactly where the failure happens and tighten the recommendation.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  DominaTang created 4 months ago

  The 404 error is it because angular 21, the index.html is under browser subfolder now. modify the CICD. these two lines must be removed options.WildcardDomainsFormat.Add($@"{configuration["App:OpenIddictWildcardDomainsFormat"]}signin-oidc"); options.WildcardDomainsFormat.Add($@"{configuration["App:OpenIddictWildcardDomainsFormat"]}signout-callback-oidc");

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 4 months ago

  Support Team Fullstack Developer

  Thanks DominaTang

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel