AuthServer Not Working in v7.0 in Microservices K8S Environment #4331

11 Answer(s)

• 

  0

  gterdem created 2 years ago

  Senior .NET Developer

  This may be related to https://github.com/openiddict/openiddict-core/issues/1613

  Please contact me via email at galip.erdem@volosoft.com so we can schedule a remote meeting that I can check.

  Save Cancel
• 

  0

  gterdem created 2 years ago

  Senior .NET Developer

  The problem is about CustomSignInManager configuration is done before configuring the OpenIddictServer issuer.

  Under PreConfigureServices:

  PreConfigure<AbpOpenIddictAspNetCoreOptions>(options =>
  {
      options.AddDevelopmentEncryptionAndSigningCertificate = false;
  });
  
  PreConfigure<OpenIddictServerBuilder>(builder =>
  {
      builder.AddSigningCertificate(GetSigningCertificate(hostingEnvironment, configuration));
      builder.AddEncryptionCertificate(GetSigningCertificate(hostingEnvironment, configuration));
      builder.SetIssuer(new Uri(configuration["AuthServer:Authority"]));
  });
  
  PreConfigure<IdentityBuilder>(identityBuilder =>
  {
      identityBuilder.AddSignInManager<CustomSignInManager>();
  });
  

  When the CustomSignInManager configured, Account/Login tries to redirect to initial appsettings configuration (localhost:44322) instead of overwritten issuer value.

  Save Cancel
• 

  0

  thedatacrew created 2 years ago

  Hi,

  After fixing the routes and retesting the following code does not load the CustomSignInManager

  
  public override void PreConfigureServices(ServiceConfigurationContext context)
  {
      Configure<IdentityBuilder>(identityBuilder =>
      {
          identityBuilder.AddSignInManager<CustomSignInManager>();
      });
     
  }
  

  Save Cancel
• 

  0

  maliming created 2 years ago

  Support Team Fullstack Developer

  hi

  You need to use PreConfigure method.

  public override void PreConfigureServices(ServiceConfigurationContext context)
  {
      PreConfigure<IdentityBuilder>(identityBuilder =>
      {
          identityBuilder.AddSignInManager<CustomSignInManager>();
      });
  }
  

  Can you share the code of CustomSignInManager?

  Save Cancel
• 

  0

  thedatacrew created 2 years ago

  Hi,

  I had a call with Galip, the PreConfigure causes an issue with OpenIddict 4, where as when we tried the Configure it's does not work at all. Waiting on a fix for this.

  Save Cancel
• 

  0

  thedatacrew created 2 years ago

  Hi,

  @gterdem - Is there any know fix for this yet?

  Thanks

  Save Cancel
• 

  0

  gterdem created 2 years ago

  Senior .NET Developer

  We’re still investigating.

  Save Cancel
• 

  0

  thedatacrew created 2 years ago

  I got a bit further by using the helm configmap to override the appsettings so that it uses the correct url. However i now get the following error.

  Everything is running non http on k8s.

  Volo.Abp.AbpException: Could not retrieve the OpenId Connect discovery document! ErrorType: PolicyViolation. Error: Endpoint does not use HTTPS: http://auth.mycompany.net/connect/authorize
  

  Save Cancel
• 

  0

  gterdem created 2 years ago

  Senior .NET Developer

  @thedatacrew

  Can you share authserver module PreConfigureServices method please?

  Save Cancel
• 

  0

  thedatacrew created 2 years ago

  Here you go, it still doesn't work with the custom sign in manager that causes the issue. CustomSignInManager talks remotely to the NetworkSecurityService via HTTP API to fetch IP Address Permissions for the Tenant. Could it be this that causes the AuthServer to raise the error?

  It all works locally though.

  using System;
  using System.Collections.Generic;
  using System.IO;
  using System.Linq;
  using System.Security.Cryptography.X509Certificates;
  
  using Microsoft.AspNetCore.Authentication.Google;
  using Microsoft.AspNetCore.Authentication.MicrosoftAccount;
  using Microsoft.AspNetCore.Authentication.Twitter;
  using Microsoft.AspNetCore.Builder;
  using Microsoft.AspNetCore.Cors;
  using Microsoft.AspNetCore.DataProtection;
  using Microsoft.AspNetCore.Hosting;
  using Microsoft.AspNetCore.Identity;
  using Microsoft.Extensions.Configuration;
  using Microsoft.Extensions.DependencyInjection;
  using Microsoft.Extensions.DependencyInjection.Extensions;
  using Microsoft.Extensions.Hosting;
  
  using MyCompany.AdministrationService.EntityFrameworkCore;
  using MyCompany.IdentityService.EntityFrameworkCore;
  using MyCompany.NetworkSecurityService;
  using MyCompany.SaasService.EntityFrameworkCore;
  using MyCompany.Shared.Hosting.AspNetCore;
  
  using OpenIddict.Server.AspNetCore;
  
  using Prometheus;
  
  using Serilog;
  
  using StackExchange.Redis;
  
  using Volo.Abp;
  using Volo.Abp.Account;
  using Volo.Abp.Account.Public.Web;
  using Volo.Abp.Account.Public.Web.ExternalProviders;
  using Volo.Abp.Account.Public.Web.Impersonation;
  using Volo.Abp.Account.Web;
  using Volo.Abp.AspNetCore.Mvc.UI.Bundling;
  using Volo.Abp.AspNetCore.Mvc.UI.Theme.LeptonX;
  using Volo.Abp.AspNetCore.Mvc.UI.Theme.LeptonX.Bundling;
  using Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared;
  using Volo.Abp.Auditing;
  using Volo.Abp.BackgroundJobs.RabbitMQ;
  using Volo.Abp.Caching;
  using Volo.Abp.Caching.StackExchangeRedis;
  using Volo.Abp.Emailing;
  using Volo.Abp.EventBus.RabbitMq;
  using Volo.Abp.Http.Client.IdentityModel;
  using Volo.Abp.Identity;
  using Volo.Abp.LeptonX.Shared;
  using Volo.Abp.Modularity;
  using Volo.Abp.MultiTenancy;
  using Volo.Abp.OpenIddict;
  using Volo.Abp.UI.Navigation.Urls;
  using Volo.Abp.VirtualFileSystem;
  using Volo.Saas.Host;
  namespace MyCompany.AuthServer;
  [DependsOn(
      typeof(AbpCachingStackExchangeRedisModule),
      typeof(AbpEventBusRabbitMqModule),
      typeof(AbpBackgroundJobsRabbitMqModule),
      typeof(AbpAspNetCoreMvcUiLeptonXThemeModule),
      typeof(AbpAccountPublicWebOpenIddictModule),
      typeof(AbpAccountPublicApplicationModule),
      typeof(AbpAccountPublicHttpApiModule),
      typeof(AbpAccountPublicWebImpersonationModule),
      typeof(AbpHttpClientIdentityModelModule),
      typeof(AdministrationServiceEntityFrameworkCoreModule),
      typeof(IdentityServiceEntityFrameworkCoreModule),
      typeof(SaasServiceEntityFrameworkCoreModule),
      typeof(SaasHostApplicationContractsModule),
      typeof(MyCompanySharedHostingAspNetCoreModule),
      typeof(MyCompanySharedLocalizationModule),
      typeof(NetworkSecurityServiceHttpApiClientModule)
  )]
  public class MyCompanyAuthServerModule : AbpModule
  {
      public override void PreConfigureServices(ServiceConfigurationContext context)
      {
          var hostingEnvironment = context.Services.GetHostingEnvironment();
          var configuration = context.Services.GetConfiguration();
  
  
          PreConfigure<OpenIddictBuilder>(builder =>
          {
              builder.AddValidation(options =>
              {
                  options.AddAudiences("AccountService");
                  options.UseLocalServer();
                  options.UseAspNetCore();
              });
  
              builder.AddServer(builder =>
              {
  
                  if (!Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]))
                  {
                      builder.UseAspNetCore().DisableTransportSecurityRequirement();
                  }
  
                  builder.Configure(options =>
                  {
  
                      var validIssuers = (configuration.GetSection("AuthServer:ValidIssuers").Get<string[]>() ?? Array.Empty<string>());
  
                      var validIssuerList = validIssuers.Select(validIssuer => validIssuer.EnsureEndsWith('/')).ToList();
  
                      options.TokenValidationParameters.ValidIssuers = validIssuerList;
  
                      Log.Information("OpenIddictBuilder TokenValidationParameters.ValidIssuers are {@ValidIssuers}", validIssuers);
  
                  });
              });
  
          });
  
          if (!hostingEnvironment.IsDevelopment())
          {
              PreConfigure<AbpOpenIddictAspNetCoreOptions>(options =>
              {
                  options.AddDevelopmentEncryptionAndSigningCertificate = false;
              });
  
              PreConfigure<OpenIddictServerBuilder>(builder =>
              {
                  builder.AddSigningCertificate(GetSigningCertificate(hostingEnvironment, configuration));
                  builder.AddEncryptionCertificate(GetSigningCertificate(hostingEnvironment, configuration));
                  builder.SetIssuer(new Uri(configuration["AuthServer:Authority"]));
              });
          }
  
          
          // TODO : Removing for now as it breaks auth server.
          //
  
          // PreConfigure<IdentityBuilder>(builder =>
          // {
          //     builder.AddSignInManager<CustomSignInManager>();
          // });
  
      }
  
      public override void ConfigureServices(ServiceConfigurationContext context)
      {
          var hostingEnvironment = context.Services.GetHostingEnvironment();
          var configuration = context.Services.GetConfiguration();
  
          if (!Convert.ToBoolean(configuration["App:DisablePII"]))
          {
              Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;
          }
  
          if (!Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]))
          {
              Configure<OpenIddictServerAspNetCoreOptions>(options =>
              {
                  options.DisableTransportSecurityRequirement = true;
              });
          }
  
          ConfigureBundles();
          ConfigureSwagger(context, configuration);
          ConfigureSameSiteCookiePolicy(context);
          ConfigureExternalProviders(context);
  
          context.Services.Configure<AbpTenantResolveOptions>(options =>
          {
              options.TenantResolvers.Clear();
              options.TenantResolvers.Add(new CurrentUserTenantResolveContributor());
          });
  
          Configure<AbpMultiTenancyOptions>(options =>
          {
              options.IsEnabled = true;
          });
  
          Configure<AbpAccountOptions>(options =>
          {
              // For impersonation in Saas module
              options.TenantAdminUserName = "admin";
              options.ImpersonationTenantPermission = SaasHostPermissions.Tenants.Impersonation;
  
              // For impersonation in Identity module
              options.ImpersonationUserPermission = IdentityPermissions.Users.Impersonation;
          });
  
          Configure<AbpAuditingOptions>(options =>
          {
              options.ApplicationName = "AuthServer";
          });
  
          Configure<AppUrlOptions>(options =>
          {
              options.Applications["MVC"].RootUrl = configuration["App:SelfUrl"];
              options.RedirectAllowedUrls.AddRange(configuration["App:RedirectAllowedUrls"].Split(','));
          });
  
          Configure<AbpDistributedCacheOptions>(options =>
          {
              options.KeyPrefix = "MyCompany:";
          });
  
          var dataProtectionBuilder = context.Services.AddDataProtection().SetApplicationName("MyCompany");
          var redis = ConnectionMultiplexer.Connect(configuration["Redis:Configuration"]);
          dataProtectionBuilder.PersistKeysToStackExchangeRedis(redis, "MyCompany-Protection-Keys");
  
          context.Services.AddCors(options =>
          {
              options.AddDefaultPolicy(builder =>
              {
                  builder
                      .WithOrigins(
                          configuration["App:CorsOrigins"]
                              .Split(",", StringSplitOptions.RemoveEmptyEntries)
                              .Select(o => o.Trim().RemovePostFix("/"))
                              .ToArray()
                      )
                      .WithAbpExposedHeaders()
                      .SetIsOriginAllowedToAllowWildcardSubdomains()
                      .AllowAnyHeader()
                      .AllowAnyMethod()
                      .AllowCredentials();
              });
          });
  
  #if DEBUG
          context.Services.Replace(ServiceDescriptor.Singleton<IEmailSender, NullEmailSender>());
  #endif
  
          if (hostingEnvironment.IsDevelopment())
          {
              Configure<AbpVirtualFileSystemOptions>(options =>
              {
                  options.FileSets.ReplaceEmbeddedByPhysical<MyCompanySharedLocalizationModule>(Path.Combine(
                      hostingEnvironment.ContentRootPath,
                      $"..{Path.DirectorySeparatorChar}..{Path.DirectorySeparatorChar}..{Path.DirectorySeparatorChar}..{Path.DirectorySeparatorChar}shared{Path.DirectorySeparatorChar}MyCompany.Shared.Localization"));
              });
          }
  
          Configure<LeptonXThemeOptions>(options =>
          {
              options.DefaultStyle = LeptonXStyleNames.System;
          });
      }
  
      public override void OnApplicationInitialization(ApplicationInitializationContext context)
      {
          var app = context.GetApplicationBuilder();
          var env = context.GetEnvironment();
  
          var configuration = context.ServiceProvider.GetRequiredService<IConfiguration>();
  
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
          }
  
          app.UseAbpRequestLocalization();
  
          if (!env.IsDevelopment())
          {
              app.UseErrorPage();
          }
  
          app.UseCorrelationId();
          app.UseAbpSecurityHeaders();
          app.UseStaticFiles();
          app.UseRouting();
          app.UseCors();
          app.UseCookiePolicy();
          app.UseHttpMetrics();
          app.UseAuthentication();
          app.UseAbpOpenIddictValidation();
          app.UseMultiTenancy();
          app.UseAbpSerilogEnrichers();
          app.UseUnitOfWork();
          app.UseAuthorization();
          app.UseSwagger();
          app.UseAbpSwaggerUI(options =>
          {
              options.SwaggerEndpoint("/swagger/v1/swagger.json", "Account Service API");
              options.OAuthClientId(configuration["AuthServer:SwaggerClientId"]);
          });
          app.UseAuditing();
          app.UseConfiguredEndpoints(endpoints =>
          {
              endpoints.MapMetrics();
          });
      }
  
      private void ConfigureBundles()
      {
          Configure<AbpBundlingOptions>(options =>
          {
              options.StyleBundles.Configure(
                  LeptonXThemeBundles.Styles.Global,
                  bundle =>
                  {
                      bundle.AddFiles("/global-styles.css");
                  }
              );
          });
      }
  
      private void ConfigureExternalProviders(ServiceConfigurationContext context)
      {
          context.Services.AddAuthentication()
              .AddGoogle(GoogleDefaults.AuthenticationScheme, _ => { })
              .WithDynamicOptions<GoogleOptions, GoogleHandler>(
                  GoogleDefaults.AuthenticationScheme,
                  options =>
                  {
                      options.WithProperty(x => x.ClientId);
                      options.WithProperty(x => x.ClientSecret, isSecret: true);
                  }
              )
              .AddMicrosoftAccount(MicrosoftAccountDefaults.AuthenticationScheme, options =>
              {
                  //Personal Microsoft accounts as an example.
                  options.AuthorizationEndpoint = "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize";
                  options.TokenEndpoint = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token";
              })
              .WithDynamicOptions<MicrosoftAccountOptions, MicrosoftAccountHandler>(
                  MicrosoftAccountDefaults.AuthenticationScheme,
                  options =>
                  {
                      options.WithProperty(x => x.ClientId);
                      options.WithProperty(x => x.ClientSecret, isSecret: true);
                  }
              )
              .AddTwitter(TwitterDefaults.AuthenticationScheme, options => options.RetrieveUserDetails = true)
              .WithDynamicOptions<TwitterOptions, TwitterHandler>(
                  TwitterDefaults.AuthenticationScheme,
                  options =>
                  {
                      options.WithProperty(x => x.ConsumerKey);
                      options.WithProperty(x => x.ConsumerSecret, isSecret: true);
                  }
              );
      }
  
      private X509Certificate2 GetSigningCertificate(IWebHostEnvironment hostingEnv, IConfiguration configuration)
      {
          var fileName = "authserver.pfx";
          var passPhrase = "XXXXXXXXXXXXX-XXXXX-XXXX-XXXX-XXXXXXXXXXX";
          var file = Path.Combine(hostingEnv.ContentRootPath, fileName);
  
          if (!File.Exists(file))
          {
              throw new FileNotFoundException($"Signing Certificate couldn't found: {file}");
          }
  
          return new X509Certificate2(file, passPhrase);
      }
  
      private void ConfigureSwagger(ServiceConfigurationContext context, IConfiguration configuration)
      {
          SwaggerConfigurationHelper.ConfigureWithAuth(
              context: context,
              authority: configuration["AuthServer:Authority"],
              scopes: new Dictionary<string, string> {
                  /* Requested scopes for authorization code request and descriptions for swagger UI only */
                  { "AccountService", "Account Service API" }
              },
              apiTitle: "Account Service API"
          );
      }
  
      private void ConfigureSameSiteCookiePolicy(ServiceConfigurationContext context)
      {
          context.Services.AddSameSiteCookiePolicy();
      }
  }
  
  

  Save Cancel
• 

  0

  gterdem created one year ago

  Senior .NET Developer

  Hi thedatacrew,

  Can you update to version 7.1 preview and let us know if this problem still persist?

  Save Cancel