Error deploying to Kubernetes #9898

8 Answer(s)

• 

  0

  AI-Bot created 16 hours ago

  Support Team ABP Agent

  The error message in your screenshot indicates an issue with the OpenID Connect discovery document, specifically: "error validating authorization_endpoint in discovery document ['https for all urls required. Also for urls received by discovery.']". This means that all URLs in your OpenIddict/OpenID Connect configuration must use HTTPS, and any endpoints returned by the discovery document must also be HTTPS.

  This is a common issue when deploying ABP microservice solutions to Kubernetes or other environments where HTTPS is enforced.

  Steps to resolve:

  1. Ensure all URLs in your appsettings and environment variables use HTTPS, not HTTP. This includes:

     • AuthServer:Authority
     • AuthServer:MetaAddress
     • IdentityClients:Default:Authority
     • RemoteServices:...:BaseUrl

  2. Make sure your Kubernetes ingress/controller is configured to serve HTTPS and that your certificates are valid.

  3. In your OpenIddict server configuration, set the issuer to the correct HTTPS URL:

  PreConfigure<OpenIddictServerBuilder>(builder =>
     {
         builder.SetIssuer(new Uri(configuration["AuthServer:Authority"])); // Should be HTTPS
     });
  

  4. If you are using self-signed certificates for local development, ensure your browser trusts them. For production, use a valid certificate authority.

  5. After making these changes, clear your browser cache and tokens.

  For more details and troubleshooting steps, see:

  • ABP Support: Angular Front-End Redirect Auth Issue Kubernetes Deployment
  • ABP Support: Angular Front-End Redirect Auth Issue Kubernetes Deployment (related)

  These steps should resolve the "https for all urls required" error and allow your ABP Angular application to authenticate correctly in Kubernetes.

  Sources:

  • https://abp.io/support/questions/6033
  • https://abp.io/support/questions/5701

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  icoretchi created 16 hours ago

  I think I need a human assistance

  Save Cancel
• 

  0

  maliming created 7 hours ago

  Support Team Fullstack Developer

  hi

  Are you using HTTP as the authserve scheme?

  Can you try to set requireHttps to false in oAuthConfig

  const oAuthConfig = {
    issuer: 'http://abp.io/',
    redirectUri: baseUrl,
    clientId: 'Bluestar_App',
    responseType: 'code',
    scope: 'offline_access Bluestar',
    requireHttps: false,
  };
  

  Thanks.

  Save Cancel
• 

  0

  icoretchi created 3 hours ago

  Hi,

  I think the problem is with openid-configuration:

  the scheme for different types of authorization endpoints are http instead of https. Can you tell me how is populated?

  Save Cancel
• 

  0

  maliming created 3 hours ago

  Support Team Fullstack Developer

  hi

  Please set the issuer, and add a middleware to set ctx.Request.Scheme to HTTPS

  public override void PreConfigureServices(ServiceConfigurationContext context)
  {
      PreConfigure<OpenIddictServerBuilder>(serverBuilder =>
      {
          serverBuilder.AddProductionEncryptionAndSigningCertificate("openiddict.pfx", configuration["AuthServer:CertificatePassPhrase"]!);
          serverBuilder.SetIssuer(new Uri(configuration["AuthServer:Authority"]!));
      });
  }
  

  public override void OnApplicationInitialization(ApplicationInitializationContext context)
  {
      var app = context.GetApplicationBuilder();
      var env = context.GetEnvironment();
  
      app.Use((ctx, next) =>
      {
          /* This application should act like it is always called as HTTPS.
           * Because it will work in a HTTPS url in production,
           * but the HTTPS is stripped out in Ingress controller.
           */
          ctx.Request.Scheme = "https";
          return next();
      });
  

  Save Cancel
• 

  0

  icoretchi created 2 hours ago

  Hi,

  This is working. Not generating the mentioned errors, but appears problem in Administration service which error the following:

  Save Cancel
• 

  0

  maliming created 2 hours ago

  Support Team Fullstack Developer

  hi

  Can you confirm your Administration service can communicate with the authserver website?

  https://abp.io/community/articles/common-errors-in-jwt-bearer-authentication-4u3wrbs5#gsc.tab=0

  Thanks

  Save Cancel
• 

  0

  icoretchi created an hour ago

  Hi,

  As you can see the error is IDX10204: Unable to validate issuer. validationParameters.ValidIssuer is null or whitespace AND validationParameters.ValidIssuers is null or empty. Obviously is something wrong in their communication, Sincerely speaking I am using abp provided helm files without any modification, just put it my domains. Do you have any sample application deployed to the external production Kubernetes cluster, just for me to compare helm manifests?

  Save Cancel