OpenIddict jwks endpoint returns 404 behind a proxy #9595

4 Answer(s)

• 

  0

  AI-Bot created 2 months ago

  Support Team ABP Agent

  • The .well-known/jwks endpoint returning 404 in ABP OpenIddict is typically due to missing or misconfigured signing/encryption certificates, or incorrect OpenIddict server setup—especially behind a proxy or API gateway.

  Solution Steps:

  1. Certificate Configuration

     • Ensure you have configured production certificates for OpenIddict. If no valid signing certificate is loaded, the JWKS endpoint will not be available.
     • In your module, use:

       PreConfigure<OpenIddictServerBuilder>(serverBuilder =>
       {
           var flag = X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.EphemeralKeySet;
           serverBuilder.AddProductionEncryptionAndSigningCertificate("openiddict.pfx", "YourCertificatePassword", flag);
       });
       

     • Make sure the openiddict.pfx file is present in your deployment and the password is correct.

  2. Proxy/Forwarded Headers

     • When running behind a proxy (like krakend or AKS ingress), configure forwarded headers in your ABP app:

       app.UseForwardedHeaders(new ForwardedHeadersOptions
       {
           ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
       });
       

     • This ensures OpenIddict generates correct URLs and processes requests as expected.

  3. Check PathBase and Routing

     • If you use app.UsePathBase("/auth") or similar, ensure your proxy forwards the base path and that all OpenIddict endpoints are accessible under the correct path.

  4. Verify Endpoint Exposure

     • The JWKS endpoint should be exposed by default if OpenIddict is correctly configured. If you have custom endpoint configuration, ensure .well-known/jwks is not excluded.

  5. Restart and Logs

     • After making changes, restart your service and check logs for certificate loading errors or OpenIddict warnings.

  References:

  • ABP OpenIddict Deployment
  • ABP Forwarded Headers (Proxy/Load Balancer)

  These steps should resolve the 404 on .well-known/jwks behind your proxy. If the issue persists, double-check certificate presence and permissions, and ensure your proxy is not stripping or rewriting the path.

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  mattw@agilenova.com created 2 months ago

  Based on further testing, I have determined that the JWKS Uri must match the ABP HttpApi host URI in order to be available.

  If ABP is running on port 44378 and I set AuthServer.Authority to https://localhost:44378, it works. If I forward port 8443 to 44378 and set the AuthServer.Authority (see below) to https://localhost:8443 the JWKS Uri is NOT available (while all other OpenIddict Uris are available).

  options.SetIssuer(new Uri(configuration["AuthServer:Authority"])); options.SetJsonWebKeySetEndpointUris(configuration["AuthServer:Authority"]+"/.well-known/jwks");

  I need to set the Issuer to https://localhost:8443 so that the Angular front-end authenticates via the proxy endpoint instead of the backend endpoint (which is not exposed).

  How do I configure OpenIddict's JWKS URI to load using a proxied/external Issuer Uri?

  Thanks!

  Save Cancel
• 

  0

  mattw@agilenova.com created 2 months ago

  I solved the issue by leaving SetIssuer set to the external URI (:8443) and passing both URIs (8443 and 44378) to the SetJsonWebKey... method: options.SetJsonWebKeySetEndpointUris( configuration["AuthServer:Authority"] + "/.well-known/jwks", configuration["AuthServer:InternalAuthority"] + "/.well-known/jwks" );

  FYI - I later.learned that KrakenD CE (opensource) follows redirects and subsequently cannot be used to proxy authentication. Only the Enterprise edition allows you to disable 302 redirects to allow the client (browser) to handle the 302 (not the gateway).

  Save Cancel
• 

  0

  maliming created 2 months ago

  Support Team Fullstack Developer

  Thanks for your solution 👍

  Save Cancel