Open Closed

ABP 10.6 – OpenIddict Discovery Endpoint Returns 404/504 in DEV but Works Locally #10870

User avatar
0
Yaduraj.Shakti created

Problem statement

We have an ABP.io application using Angular + .NET Core + OpenIddict. After upgrading the application to ABP 10.6.0, the OpenID Connect discovery endpoint is not accessible in our DEV hosted environment.

The endpoint works correctly when running locally, but returns 404 or 504 in DEV.

Working locally

https://localhost:44350/.well-known/openid-configuration

This returns the expected OpenID Connect discovery document.

Failing in DEV

https://api-product.dev.<COMPANY_DOMAIN>/.well-known/openid-configuration

This returns either:

404 Not Found or 504 Gateway Timeout

Architecture

Our deployment architecture is:

Angular Application
        |
        | OIDC discovery request
        |
        v
`https://api-product.dev.&lt;company_domain&gt;`
        |
        +-- /Account/Login
        +-- /connect/authorize
        +-- /connect/token
        +-- /.well-known/openid-configuration
        |
        v
AWS API Gateway / VPC Link
        |
        v
AWS ECS
        |
        v
ASP.NET Core / ABP AuthServer
        |
        v
OpenIddict

There is not a separate public AuthServer hostname in this environment.

The following URL is our AuthServer:

https://api-product.dev.<company_domain>/Account/Login

We were previously able to access the AuthServer login page successfully using this URL. Therefore App:SelfUrl is intentionally configured to the same public host: https://api-product.dev.<COMPANY_DOMAIN>. The issue occurs before the user logs in. When the Angular application is opened, the OIDC client automatically requests the discovery endpoint during authentication initialization.

Current configuration

Our AuthServer appsettings.json contains:

{
  "App": {
    "SelfUrl": "https://api-product.dev.<company_domain>",
    "CorsOrigins": "https://*.litmus.financial,https://*.<company_domain>,http://localhost:4200"
  }
}

C# Openiddict configuration

using Microsoft.Extensions.Logging;
using Volo.Abp.OpenIddict;

[DependsOn(typeof(AbpAccountPublicWebOpenIddictModule))]
public class LitmusIdentityServerModule : AbpModule
{
    private static string _configuredIssuer;
    private static bool _isDefaultIssuer;

    public override void PreConfigureServices(ServiceConfigurationContext context)
    {
        var configuration = context.Services.GetConfiguration();

        PreConfigure<OpenIddictBuilder>(builder =>
        {
            builder.AddServer(options =>
            {
                options.AllowPasswordFlow();
                options.AllowClientCredentialsFlow();
                options.AllowAuthorizationCodeFlow();
                options.AllowImplicitFlow();
                options.AllowDeviceAuthorizationFlow();
                options.AllowRefreshTokenFlow();
            });
            
            builder.AddValidation(options =>
            {
                options.AddAudiences(/* configured scopes/audiences */);
                options.UseLocalServer();
                options.UseAspNetCore();
            });
        });

        PreConfigure<OpenIddictServerBuilder>(builder =>
        {
            // Issuer configuration
            var selfUrl = configuration["App:SelfUrl"];
           
            // Grant types
            builder.AllowPasswordFlow();
            builder.AllowClientCredentialsFlow();
            builder.AllowAuthorizationCodeFlow();
            builder.AllowImplicitFlow();
            builder.AllowDeviceAuthorizationFlow();
            builder.AllowRefreshTokenFlow();

            // Explicit endpoint configuration
            builder.SetAuthorizationEndpointUris("/connect/authorize");
            builder.SetTokenEndpointUris("/connect/token");
            builder.SetIntrospectionEndpointUris("/connect/introspect");
            builder.SetRevocationEndpointUris("/connect/revocation");
            builder.SetConfigurationEndpointUris("/.well-known/openid-configuration");
            builder.SetUserInfoEndpointUris("/connect/userinfo");
        });

        if (!hostingEnvironment.IsDevelopment())
        {
            PreConfigure<AbpOpenIddictAspNetCoreOptions>(options =>
            {
                options.AddDevelopmentEncryptionAndSigningCertificate = false;
            });

            PreConfigure<OpenIddictServerBuilder>(builder =>
            {
                builder.AddSigningCertificate(GetSigningCertificate(hostingEnvironment, configuration));
                builder.AddEncryptionCertificate(GetSigningCertificate(hostingEnvironment, configuration));
            });
        }
    }

    public override void OnApplicationInitialization(ApplicationInitializationContext context)
    {
        var logger = context.ServiceProvider.GetRequiredService<ILogger<LitmusIdentityServerModule>>();

        if (!string.IsNullOrEmpty(_configuredIssuer))
        {
            if (_isDefaultIssuer)
                logger.LogWarning("OpenIddict issuer: App:SelfUrl not configured. Using default: {Issuer}", _configuredIssuer);
            else
                logger.LogInformation("OpenIddict issuer configured from App:SelfUrl: {Issuer}", _configuredIssuer);
        }
        
        // ... rest of initialization
    }
}

<PackageReference Include="Volo.Abp.Account.Pro.Public.Web.OpenIddict" Version="10.6.0" />
Additional information
  • Deployment is not exposing/using /getEnvConfig
  • We dont have seperate public URL for Auth Server but via https://api-product.dev.<company_domain>/Account/Login

Expectation

We would appreciate a short call with the ABP team so we can share the complete code/configuration and demonstrate the issue live, which should help us identify and resolve the root cause faster.

Note: Our team member has previously raised the following tickets for similar issues encountered during the upgrade.

#10864 #10858

  • Exception message and full stack trace:
  • Steps to reproduce the issue:
Markdown supported.
Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
Go to accepted answer
31 Answer(s)
  • User Avatar
    0
    AI-Bot created
    Support Team ABP Agent

    • In ABP 10.6 (OpenIddict), when your AuthServer is behind a reverse proxy/API Gateway that terminates TLS, the AuthServer process may see the incoming request as HTTP (or with a different host), unless forwarded headers are applied correctly.

      • This typically results in OpenIddict endpoints (including /.well-known/openid-configuration) behaving unexpectedly in hosted environments (404 via unmatched route/proxy mapping, or 504 due to gateway retries/timeouts), while still working locally.

    • Fix it by ensuring the AuthServer trusts and applies forwarded headers (scheme/host), before ABP endpoints are executed.

    Solution

    1) Enable forwarded headers in the AuthServer pipeline

    In your AuthServer project module (*.HttpApi.Host / AuthServer host module), add UseForwardedHeaders() early in OnApplicationInitialization.

    Example:

    using Microsoft.AspNetCore.HttpOverrides;
using Volo.Abp;

public override void OnApplicationInitialization(ApplicationInitializationContext context)
{
    var app = context.GetApplicationBuilder();

    app.UseForwardedHeaders(new ForwardedHeadersOptions
    {
        ForwardedHeaders =
            ForwardedHeaders.XForwardedFor |
            ForwardedHeaders.XForwardedProto |
            ForwardedHeaders.XForwardedHost
    });

    // If your proxy is not in KnownNetworks/KnownProxies, you may need:
    // options.KnownNetworks.Clear();
    // options.KnownProxies.Clear();

    // Continue with the standard ABP pipeline...
}

    This ensures OpenIddict sees the request as https://api-product.dev.<company_domain> (instead of http://<internal-host>:<port>), so discovery generation/routing matches what the Angular OIDC client expects.

    2) Ensure AWS API Gateway forwards the required headers

    Configure API Gateway / VPC Link integration so the backend receives:

    • X-Forwarded-Proto: https
    • X-Forwarded-Host: api-product.dev.<company_domain>
    • X-Forwarded-For: <client-ip>

    Without these, UseForwardedHeaders() can’t reconstruct the external URL correctly.

    3) Don’t rely on custom SetConfigurationEndpointUris unless necessary

    ABP/OpenIddict already exposes the discovery endpoint by default. Keeping custom endpoint URI setup is usually fine, but if your proxy rewrites paths or strips /.well-known/*, remove the explicit endpoint overrides and retest to eliminate path-mapping issues at the gateway layer.

    4) About the “short call” request

    For scheduling/support coordination (non-technical/support process), please contact us at: https://abp.io/contact

    Sources

    • https://abp.io/docs/latest/deployment/forwarded-headers
    • https://abp.io/docs/latest/solution-templates/layered-web-application/deployment/openiddict-deployment
    • https://abp.io/docs/10.6/modules/openiddict
    • https://abp.io/contact

    This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    A 404 for /.well-known/openid-configuration isn't something the AuthServer produces by itself. When a request with that path reaches it, OpenIddict handles it, it doesn't fall through to a 404, and a CORS preflight for it is answered by the CORS middleware or by OpenIddict, again not with a 404. So the 404 means the request didn't reach the AuthServer, reached it with a different path, or reached a different service. The 504 is API Gateway not getting a response from the integration in time.

    So start with the API Gateway route for this path. It needs the same integration as /Account/Login, and OPTIONS has to be covered too, either forwarded or answered by the gateway's CORS config, because the browser sends a preflight for this URL (the screenshot in https://abp.io/support/questions/10858/ shows that OPTIONS request getting the 404).

    The AuthServer log tells you which side it is. Search the logs of all tasks for one failing request:

    Request starting ... /.well-known/openid-configuration
Request finished ... /.well-known/openid-configuration - <status> ...
    • No Request starting line: the request never reached the AuthServer, fix the route/integration.
    • The line is there but with a different path, or the app itself answered 404: the gateway rewrites the path, or that ECS service doesn't host OpenIddict. When OpenIddict does pick up the path it also logs The request URI matched a server endpoint: Configuration.
    • 400 with "This server only accepts HTTPS requests": the task receives plain HTTP after TLS termination at the gateway. If your module still has the template's AuthServer:RequireHttpsMetadata check, set it to false in the DEV appsettings. If that part was removed, add this to ConfigureServices:
    using OpenIddict.Server.AspNetCore;

Configure<OpenIddictServerAspNetCoreOptions>(options =>
{
    options.DisableTransportSecurityRequirement = true;
});
    • Request finished with 200 in a few ms while the public URL gets 504: the problem is between API Gateway and the task, check the API Gateway access log and the integration latency for that request. No Request finished at all: the app is hanging on that request, and the lines before it show on what.

    Send the AuthServer log around one failing request, the API Gateway log for the same request, and the route/integration config for this path to liming.ma@volosoft.com and we'll go through it with you.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    Yaduraj.Shakti created

    Hi @maliming,

    Thank for the quick response. I have shared the logs in mail

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    AI-Bot created
    Support Team ABP Agent
    • Noted — since you’ve already emailed the logs, the remaining actionable checks on your side (that commonly explain 404/504 for /.well-known/openid-configuration behind AWS API Gateway) are:

    Solution

    1. Verify API Gateway routing for BOTH GET and OPTIONS
    • Ensure /.well-known/openid-configuration is mapped to the same integration/target as /Account/Login.
    • Make sure OPTIONS is handled:
      • Either forwarded to ECS, or
      • Answered by API Gateway CORS config.
    • A browser will typically preflight (OPTIONS) the discovery endpoint; if OPTIONS gets 404 at the gateway, the Angular OIDC init fails even if GET would work.
    1. Confirm the request actually reaches the AuthServer
    • In the AuthServer logs, for a failing attempt you should see lines like:
      • Request starting ... /.well-known/openid-configuration
      • Request finished ... /.well-known/openid-configuration - <status> ...
    • If there is no Request starting for that path, the problem is definitively API Gateway routing / path rewrite / wrong upstream (not ABP/OpenIddict).
    1. If you see “This server only accepts HTTPS requests” (ID2083) That means the app receives plain HTTP after TLS is terminated at the gateway.
    • Recommended fix: enable forwarded headers in the AuthServer so the app reconstructs the external scheme/host correctly:
    using Microsoft.AspNetCore.HttpOverrides;

public override void OnApplicationInitialization(ApplicationInitializationContext context)
{
    var app = context.GetApplicationBuilder();

    app.UseForwardedHeaders(new ForwardedHeadersOptions
    {
        ForwardedHeaders =
            ForwardedHeaders.XForwardedFor |
            ForwardedHeaders.XForwardedProto |
            ForwardedHeaders.XForwardedHost
    });

    // continue with ABP pipeline...
}
    • Also ensure API Gateway forwards:
      • X-Forwarded-Proto: https
      • X-Forwarded-Host: api-product.dev.<company_domain>
    1. Call request (scheduling) For arranging a short call / sharing environment details live, please use: https://abp.io/contact

    Sources

    • https://abp.io/docs/latest/deployment/forwarded-headers
    • https://abp.io/docs/latest/solution-templates/layered-web-application/deployment/openiddict-deployment
    • https://abp.io/docs/10.6/modules/openiddict
    • https://abp.io/contact

    This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    Thanks for the logs. The identity task itself is where to look. The GET /.well-known/openid-configuration in the identity log arrives with the exact path and still ends with "reached the end of the middleware pipeline" after 0.1 ms. With the standard OpenIddict setup, the OpenIddict handler in UseAuthentication takes that request and writes the response itself, so it never gets to that 404. Add /Account/Login returning 404 on localhost inside the container, and what runs in that task isn't wired up like your local run: the OpenIddict server isn't handling requests there and the Account pages aren't mapped.

    To see why, send me these from the identity host:

    1. Program.cs
    2. The complete host module class, the one with OnApplicationInitialization
    3. The .csproj of that project
    4. The ECS task definition for that container: image tag, entry point/command and container port
    5. The task's startup log from process start to the first request, without a filter on the log category
    6. From inside the container, the full response of a request to /.well-known/openid-configuration on the local port, headers included

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    Yaduraj.Shakti created

    Hi @maliming,

    Thanks, I will share soon. Please also tell me if OpenIddict table data also need to review or its not needed?

    • public."OpenIddictApplications"
    • public."OpenIddictScopes"

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    Not for this one. The discovery request isn't reaching OpenIddict at all, so nothing is read from those tables yet. They come into play once the endpoints respond: the discovery document lists the scopes from OpenIddictScopes, and OpenIddictApplications is checked on the authorize/token calls of your Angular client. Leave them as they are for now.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
    1
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    Thanks, that's enough to see it. In the identity host's Program.cs the two ABP calls aren't awaited:

    builder.AddApplicationAsync<LitmusIdentityServerModule>();
var app = builder.Build();
app.InitializeApplicationAsync();
app.Run();

    InitializeApplicationAsync is where OnApplicationInitialization runs, so it's where UseAuthentication, UseConfiguredEndpoints and the rest get added. Without the await, app.Run() starts the host straight away, and the host builds the request pipeline at that moment. If module initialization hasn't reached your module yet, nothing is in the pipeline and every request falls through to that 404. It's a timing thing, which is why it works on your machine and not on the task.

    Make Main async and await both calls, the same way the template does:

    public static async Task<int> Main(string[] args)
{
    var builder = WebApplication.CreateBuilder(args);
    // ... same as now ...
    await builder.AddApplicationAsync<LitmusIdentityServerModule>();
    var app = builder.Build();
    await app.InitializeApplicationAsync();
    await app.RunAsync();
    return 0;
}

    The HttpApi.Host Program.cs has the same two lines, change it there as well. The Startup.cs files aren't used by these Program.cs at all, you can delete them.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
    1
  • User Avatar
    0
    Yaduraj.Shakti created

    Hi @mliming,

    Thanks for quick response. I will implement and will confirm if its resolve our issue.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    ok : )

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    Yaduraj.Shakti created

    Hi @maliming,

    Now I am getting following error. I have tried updating docker to copy wwwroot to the published location but still getting same error

    2026-09-07T16:54:28.546+05:30 Info: Started envsubst process to render configuration files. 2026-09-07T16:54:28.795+05:30 Info: Rendering templates/appsettings.json.tmpl file. 2026-09-07T16:54:28.844+05:30 sh: PROJECT=product: unknown operand 2026-09-07T16:54:28.904+05:30 sh: AWS_DEFAULT_REGION=ap-southeast-1: unknown operand 2026-09-07T16:54:29.184+05:30 sh: AUTHAPIRESOURCE=Litmus: unknown operand 2026-09-07T16:54:29.243+05:30 sh: TENANTID=73105f70-6d76-46a7-a8b4-23a128bd768c: unknown operand 2026-09-07T16:54:29.399+05:30 Info: All templates files rendered successfully. 2026-09-07T16:54:29.399+05:30 Starting app service. 2026-09-07T16:54:29.948+05:30 Unhandled exception. Volo.Abp.AbpInitializationException: An error occurred during ConfigureServicesAsync phase of the module Volo.Abp.AspNetCore.AbpAspNetCoreModule, Volo.Abp.AspNetCore, Version=10.6.0.0, Culture=neutral, PublicKeyToken=null. See the inner exception for details. 2026-09-07T16:54:29.948+05:30 ---> System.IO.DirectoryNotFoundException: /src/SCV.Litmus/aspnet-core/microservices/SCV.Litmus.IdentityServer/wwwroot/ 2026-09-07T16:54:29.948+05:30 at Microsoft.Extensions.FileProviders.PhysicalFileProvider..ctor(String root, ExclusionFilters filters) 2026-09-07T16:54:29.948+05:30 at Microsoft.AspNetCore.Hosting.StaticWebAssets.StaticWebAssetsLoader.<>c.<UseStaticWebAssetsCore>b__1_0(String contentRoot) 2026-09-07T16:54:29.948+05:30 at Microsoft.AspNetCore.StaticWebAssets.ManifestStaticWebAssetFileProvider..ctor(StaticWebAssetManifest manifest, Func2 fileProviderFactory) 2026-09-07T16:54:29.948+05:30 at Microsoft.AspNetCore.Hosting.StaticWebAssets.StaticWebAssetsLoader.UseStaticWebAssetsCore(IWebHostEnvironment environment, Stream manifest) 2026-09-07T16:54:29.948+05:30 at Microsoft.AspNetCore.Hosting.StaticWebAssets.StaticWebAssetsLoader.UseStaticWebAssets(IWebHostEnvironment environment, IConfiguration configuration) 2026-09-07T16:54:29.948+05:30 at Volo.Abp.AspNetCore.AbpAspNetCoreModule.ConfigureServices(ServiceConfigurationContext context) 2026-09-07T16:54:29.948+05:30 at Volo.Abp.Modularity.AbpModule.ConfigureServicesAsync(ServiceConfigurationContext context) 2026-09-07T16:54:29.948+05:30 at Volo.Abp.AbpApplicationBase.ConfigureServicesAsync() 2026-09-07T16:54:29.948+05:30 --- End of inner exception stack trace --- 2026-09-07T16:54:29.948+05:30 at Volo.Abp.AbpApplicationBase.ConfigureServicesAsync() 2026-09-07T16:54:29.948+05:30 at Volo.Abp.AbpApplicationFactory.CreateAsync[TStartupModule](IServiceCollection services, Action1 optionsAction) 2026-09-07T16:54:29.948+05:30 at Microsoft.Extensions.DependencyInjection.ServiceCollectionApplicationExtensions.AddApplicationAsync[TStartupModule](IServiceCollection services, Action1 optionsAction) 2026-09-07T16:54:29.948+05:30 at Microsoft.Extensions.DependencyInjection.WebApplicationBuilderExtensions.AddApplicationAsync[TStartupModule](WebApplicationBuilder builder, Action1 optionsAction) 2026-09-07T16:54:29.948+05:30 at SCV.Litmus.Program.Main(String[] args) in /src/SCV.Litmus/aspnet-core/microservices/SCV.Litmus.IdentityServer/Program.cs:line 49 2026-09-07T16:54:29.948+05:30 at SCV.Litmus.Program.<Main>(String[] args) 2026-09-07T16:54:30.100+05:30 Aborted (core dumped)

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    Keep the Program.cs change. This one is the Dockerfile: it packages the dotnet build output, which includes SCV.Litmus.IdentityServer.staticwebassets.runtime.json. Switch it to the dotnet publish output, that file isn't part of it.

    The gateway image needs the same change.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    pradeep.pradyumna created

    Hi ABP team,

    Is it possible that we could get over a short call, as we 're running short of time and we have critical deliveries dependent on this upgrade we did?

    We're facing issues logging into the application post ABP IO upgrade. And I see some of your suggestions are helping but itsn;t fast enough for us to do it over support tickets and meet our deadlines.

    Just sharing a summary of .NET and Angular upgrades we did here. UPGRADE_COMPLETION_REPORT.md

    ANGULAR-22-ABP-10.6-UPGRADE-COMPLETE-SUMMARY.md

    Pls review them and let us know when can we connect today? Thanks!

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    Please share the details below before the call. Without them I'd still be working through the same things during the meeting.

    Two changes came out of this thread last week, both for the identity service:

    • Program.cs: await AddApplicationAsync and InitializeApplicationAsync, with an async Main. Yaduraj applied this one.
    • Dockerfile: package the dotnet publish output rather than the dotnet build output. No result reported on this one yet.

    Where does each stand now? Then, from the build that's running, search the identity task's startup log for this line:

    Initialized all ABP modules.

    If it's there, the ABP pipeline is up and the login problem is elsewhere. If it isn't, the app still isn't initializing, and the lines around it tell me why. Send me that part of the log, unfiltered.

    Also:

    1. From inside the container, the response of /.well-known/openid-configuration and /connect/token, status code and body
    2. What "can't log in" looks like exactly: which step it stops at, and what the browser network tab shows for the failing request

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    Yaduraj.Shakti created

    Hi @maliming

    We have done above changes, and Identity Server is working fine. We are able to generate token and openid-configuration is working fine too.

    Now the problem is application-configuration is not returning an authenticated current User.

    currentUser : {isAuthenticated: false This is always false even if login credentials are correct. Let me quickly check the task's startup log and share with you.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    Good to hear the identity service is up.

    In ABP, currentUser.isAuthenticated is Id.HasValue, so false only tells us the API ended up with no claim matching AbpClaimTypes.UserId on the principal. That covers two different things: the token not being accepted at all, or the token being fine while the user id claim sits under a different claim type than the API expects.

    To tell those apart, send me:

    1. The authentication setup of the API host, the body of your ConfigureAuthenticationSetup.ConfigureAuthentication
    2. A complete access token that produces this. If you'd rather not put it in the thread, send it to liming.ma@volosoft.com
    3. The API host's debug log and its identitymodel log, both for one application-configuration call made with that token

    Both logs are described here: https://abp.io/support/questions/8622/How-to-enable-Debug-logs-for-troubleshoot-problems

    The identitymodel one is what shows why a token gets refused. In the API host's Program.cs:

    using System.Diagnostics.Tracing;
using Microsoft.IdentityModel.Logging;

IdentityModelEventSource.ShowPII = true;
IdentityModelEventSource.Logger.LogLevel = EventLevel.Verbose;
var wilsonTextLogger = new TextWriterEventListener("Logs/identitymodel.txt");
wilsonTextLogger.EnableEvents(IdentityModelEventSource.Logger, EventLevel.Verbose);

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    pradeep.pradyumna created

    Here are the logs from Identity and Gateway projects:

    Identity API:

    identitymodel-identity.txt

    Gateway API:

    identitymodel-gateway.txt

    On the email, I'm sending you a copy of the Application and Network tab contents.

    thanks!

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    Thanks for the logs, they pinned it down. The gateway reads the discovery document over https, but the jwks_uri inside it is http://api-product.dev.tasconnect.net/.well-known/jwks, and port 80 refuses the connection. With no keys the gateway has no configuration to validate against, which is the IDX10204 you see, and the request ends up anonymous.

    OpenIddict builds the endpoint URLs of that document from the scheme of the incoming request, and the identity task receives plain HTTP once the gateway terminates TLS. SetIssuer only fixes the issuer field, not those URLs.

    In the identity host, right after app.UseForwardedHeaders() and before app.UseAuthentication():

    app.Use(async (context, next) =>
{
    if (context.Request.Path.StartsWithSegments("/.well-known"))
    {
        context.RequestServices
            .GetRequiredService<ILogger<LitmusIdentityServerModule>>()
            .LogWarning("Scheme: {Scheme}, Host: {Host}, X-Forwarded-Proto: {Proto}, X-Forwarded-Host: {ForwardedHost}",
                context.Request.Scheme,
                context.Request.Host.Value,
                context.Request.Headers["X-Forwarded-Proto"].ToString(),
                context.Request.Headers["X-Forwarded-Host"].ToString());
    }

    context.Request.Scheme = "https";

    await next();
});

    Once it's deployed, https://api-product.dev.tasconnect.net/.well-known/openid-configuration should list jwks_uri with https.

    If it still fails, send the new identitymodel logs from both projects together with those Scheme / X-Forwarded-Proto lines. They tell us what the gateway really forwards, and we go from there.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
    1
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    Thanks for the latest file. Two things, otherwise the scheme change alone won't get you there.

    The access token carries no aud claim, while the gateway sets options.Audience from AuthServer:ApiResource. Audience validation will reject it as soon as the signing keys are reachable again.

    To confirm that quickly, turn the check off for now in the JwtBearer scheme:

    options.TokenValidationParameters.ValidateAudience = false;

    If login works with that, the missing aud is what's left. The real fix is on the AuthServer side: ABP fills aud from the resources attached to the granted scopes, so the rows in OpenIddictScopes currently have none. The OpenIddict tables do matter here, contrary to what I said earlier.

    select "Name", "Resources" from "OpenIddictScopes";

    Resources of the Litmus scope has to contain the API resource name, the way the seeder creates it:

    await _scopeManager.CreateAsync(new OpenIddictScopeDescriptor {
    Name = "Litmus", DisplayName = "Litmus API", Resources = { "Litmus" }
});

    Also take options.MapInboundClaims = false back out. On the API side ABP reads the user id through AbpClaimTypes.UserId, and that stays ClaimTypes.NameIdentifier unless an OpenIddict module runs in the same process, which your gateway doesn't have. The default mapping is what turns sub into that claim, so switching it off leaves currentUser empty. AddAbpJwtBearer keeps the default for this reason, and it also explains why FindFirst("sub") in your new logging comes back null.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    Yaduraj.Shakti created

    Thanks @maliming,

    We will update the code and will share the outcome soon.

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    OK, : )

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    Hi,

    Both. They aren't alternatives, each one fixes a different project, in this order:

    1. Identity host, from https://abp.io/support/questions/10870#answer-3a23a2b0-aad3-9c4a-1b74-7106468c25bb : add the middleware that sets context.Request.Scheme = "https", after app.UseForwardedHeaders() and before app.UseAuthentication(). Once deployed, jwks_uri in /.well-known/openid-configuration has to start with https.
    2. Gateway, from https://abp.io/support/questions/10870#answer-3a23a2c1-65ae-2cd5-f4cd-b434774cfa2d : remove options.MapInboundClaims = false, and for now set options.TokenValidationParameters.ValidateAudience = false.
    3. Log in again and look at currentUser in application-configuration.

    If isAuthenticated is true after that, add the missing resources to OpenIddictScopes as described in the second reply, then turn audience validation back on. If it's still false, send the new identitymodel logs from both projects.

    Yaduraj said on Friday he was updating the code, so part of this may already be in place on his side.

    Thanks

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
    1
  • User Avatar
    0
    pradeep.pradyumna created

    [maliming] said: TokenValidationParameters

    thank you. Yaduraj is on a leave this week and the changes are not yet implemented. I just did and waiting for deployment. I'll update you soon. thank you!

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    maliming created
    Support Team Fullstack Developer

    ok : )

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
  • User Avatar
    0
    pradeep.pradyumna created

    [maliming] said: ok : )

    Sorry for the delayed response. After including changes as suggested, I still face the same issue.

    Do let me know: apart from the identitymodel logs, is there anything else you would like me to share? I could do it over email. Also, let me know if we could connect over a short call I can walk you through the code and changes we have made so far. Thank you!

    Markdown supported.
    Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
Assignee
User avatar maliming
Question details
Labels
None yet
Boost Your Development
ABP Live Training
Packages
See Trainings
Mastering ABP Framework Book
The Official Guide
Mastering
ABP Framework
Learn More
Mastering ABP Framework Book
Made with ❤️ on ABP v10.8.0-preview. Updated on September 24, 2026, 12:09
1
ABP Assistant
🔐 You need to be logged in to use the chatbot. Please log in first.