ABP 10.6 – OpenIddict Discovery Endpoint Returns 404/504 in DEV but Works Locally #10870

Problem statement

We have an ABP.io application using Angular + .NET Core + OpenIddict. After upgrading the application to ABP 10.6.0, the OpenID Connect discovery endpoint is not accessible in our DEV hosted environment.

The endpoint works correctly when running locally, but returns 404 or 504 in DEV.

Working locally

https://localhost:44350/.well-known/openid-configuration

This returns the expected OpenID Connect discovery document.

Failing in DEV

https://api-product.dev.<COMPANY_DOMAIN>/.well-known/openid-configuration

This returns either:

404 Not Found or 504 Gateway Timeout

Architecture

Our deployment architecture is:

Angular Application
        |
        | OIDC discovery request
        |
        v
`https://api-product.dev.<company_domain>`
        |
        +-- /Account/Login
        +-- /connect/authorize
        +-- /connect/token
        +-- /.well-known/openid-configuration
        |
        v
AWS API Gateway / VPC Link
        |
        v
AWS ECS
        |
        v
ASP.NET Core / ABP AuthServer
        |
        v
OpenIddict

There is not a separate public AuthServer hostname in this environment.

The following URL is our AuthServer:

https://api-product.dev.<company_domain>/Account/Login

We were previously able to access the AuthServer login page successfully using this URL. Therefore App:SelfUrl is intentionally configured to the same public host: https://api-product.dev.<COMPANY_DOMAIN>. The issue occurs before the user logs in. When the Angular application is opened, the OIDC client automatically requests the discovery endpoint during authentication initialization.

Current configuration

Our AuthServer appsettings.json contains:

{
  "App": {
    "SelfUrl": "https://api-product.dev.<company_domain>",
    "CorsOrigins": "https://*.litmus.financial,https://*.<company_domain>,http://localhost:4200"
  }
}

C# Openiddict configuration

using Microsoft.Extensions.Logging;
using Volo.Abp.OpenIddict;

[DependsOn(typeof(AbpAccountPublicWebOpenIddictModule))]
public class LitmusIdentityServerModule : AbpModule
{
    private static string _configuredIssuer;
    private static bool _isDefaultIssuer;

    public override void PreConfigureServices(ServiceConfigurationContext context)
    {
        var configuration = context.Services.GetConfiguration();

        PreConfigure<OpenIddictBuilder>(builder =>
        {
            builder.AddServer(options =>
            {
                options.AllowPasswordFlow();
                options.AllowClientCredentialsFlow();
                options.AllowAuthorizationCodeFlow();
                options.AllowImplicitFlow();
                options.AllowDeviceAuthorizationFlow();
                options.AllowRefreshTokenFlow();
            });
            
            builder.AddValidation(options =>
            {
                options.AddAudiences(/* configured scopes/audiences */);
                options.UseLocalServer();
                options.UseAspNetCore();
            });
        });

        PreConfigure<OpenIddictServerBuilder>(builder =>
        {
            // Issuer configuration
            var selfUrl = configuration["App:SelfUrl"];
           
            // Grant types
            builder.AllowPasswordFlow();
            builder.AllowClientCredentialsFlow();
            builder.AllowAuthorizationCodeFlow();
            builder.AllowImplicitFlow();
            builder.AllowDeviceAuthorizationFlow();
            builder.AllowRefreshTokenFlow();

            // Explicit endpoint configuration
            builder.SetAuthorizationEndpointUris("/connect/authorize");
            builder.SetTokenEndpointUris("/connect/token");
            builder.SetIntrospectionEndpointUris("/connect/introspect");
            builder.SetRevocationEndpointUris("/connect/revocation");
            builder.SetConfigurationEndpointUris("/.well-known/openid-configuration");
            builder.SetUserInfoEndpointUris("/connect/userinfo");
        });

        if (!hostingEnvironment.IsDevelopment())
        {
            PreConfigure<AbpOpenIddictAspNetCoreOptions>(options =>
            {
                options.AddDevelopmentEncryptionAndSigningCertificate = false;
            });

            PreConfigure<OpenIddictServerBuilder>(builder =>
            {
                builder.AddSigningCertificate(GetSigningCertificate(hostingEnvironment, configuration));
                builder.AddEncryptionCertificate(GetSigningCertificate(hostingEnvironment, configuration));
            });
        }
    }

    public override void OnApplicationInitialization(ApplicationInitializationContext context)
    {
        var logger = context.ServiceProvider.GetRequiredService<ILogger<LitmusIdentityServerModule>>();

        if (!string.IsNullOrEmpty(_configuredIssuer))
        {
            if (_isDefaultIssuer)
                logger.LogWarning("OpenIddict issuer: App:SelfUrl not configured. Using default: {Issuer}", _configuredIssuer);
            else
                logger.LogInformation("OpenIddict issuer configured from App:SelfUrl: {Issuer}", _configuredIssuer);
        }
        
        // ... rest of initialization
    }
}

<PackageReference Include="Volo.Abp.Account.Pro.Public.Web.OpenIddict" Version="10.6.0" />

Additional information

• Deployment is not exposing/using /getEnvConfig
• We dont have seperate public URL for Auth Server but via https://api-product.dev.<company_domain>/Account/Login

Expectation

We would appreciate a short call with the ABP team so we can share the complete code/configuration and demonstrate the issue live, which should help us identify and resolve the root cause faster.

Note: Our team member has previously raised the following tickets for similar issues encountered during the upgrade.

#10864 #10858

• Exception message and full stack trace:
• Steps to reproduce the issue: