Hi,
I have an ABP 9.3.6 application running on Azure that had no issues until a few days ago. This application uses Okta for authentication (a few months ago I opened the ticket #10171, but everything was resolved). From one day to the next, the application stopped working (on all environments where the application was installed: DEV, TEST, and PRODUCTION) without any changes to the application or the Okta configuration. The problem is that, once I've logged in to Okta and the application is redirected to the main page, I get a 502 error. Analyzing the Azure Log Stream , it appears the issue may be the size of the 8,890-byte session cookie generated by the ABP framework. Since we're in an Enterprise environment and it's not possible to change the Okta configuration (except at length), is there any way to reduce the cookie size programmatically?
I attach the module code to check if I used any options (e.g. app.UseDynamicClaims()) that might impact the size:
...
public class CalendarWebModule : AbpModule
{
public override void PreConfigureServices(ServiceConfigurationContext context)
{
var hostingEnvironment = context.Services.GetHostingEnvironment();
var configuration = context.Services.GetConfiguration();
context.Services.PreConfigure<AbpMvcDataAnnotationsLocalizationOptions>(options =>
{
options.AddAssemblyResource(
typeof(CalendarResource),
typeof(CalendarDomainModule).Assembly,
typeof(CalendarDomainSharedModule).Assembly,
typeof(CalendarApplicationModule).Assembly,
typeof(CalendarApplicationContractsModule).Assembly,
typeof(CalendarWebModule).Assembly
);
});
PreConfigure<OpenIddictBuilder>(builder =>
{
builder.AddValidation(options =>
{
options.AddAudiences("Calendar");
options.UseLocalServer();
options.UseAspNetCore();
});
});
if (!hostingEnvironment.IsDevelopment())
{
PreConfigure<AbpOpenIddictAspNetCoreOptions>(options =>
{
options.AddDevelopmentEncryptionAndSigningCertificate = false;
});
PreConfigure<OpenIddictServerBuilder>(serverBuilder =>
{
serverBuilder.AddProductionEncryptionAndSigningCertificate("openiddict.pfx", configuration["AuthServer:CertificatePassPhrase"]!);
serverBuilder.SetIssuer(new Uri(configuration["AuthServer:Authority"]!));
});
}
}
public override void ConfigureServices(ServiceConfigurationContext context)
{
var hostingEnvironment = context.Services.GetHostingEnvironment();
var configuration = context.Services.GetConfiguration();
if (!configuration.GetValue<bool>("App:DisablePII"))
{
Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;
Microsoft.IdentityModel.Logging.IdentityModelEventSource.LogCompleteSecurityArtifact = true;
}
if (!configuration.GetValue<bool>("AuthServer:RequireHttpsMetadata"))
{
Configure<OpenIddictServerAspNetCoreOptions>(options =>
{
options.DisableTransportSecurityRequirement = true;
});
Configure<ForwardedHeadersOptions>(options =>
{
options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost;
});
}
context.Services.AddScoped<NotyfViewComponent>();
ConfigureBundles();
ConfigureUrls(configuration);
ConfigureHealthChecks(context);
ConfigurePages(configuration);
ConfigureImpersonation(context, configuration);
ConfigureExternalProviders(context);
ConfigureCookieConsent(context);
ConfigureAuthentication(context);
ConfigureAutoMapper();
ConfigureVirtualFileSystem(hostingEnvironment);
ConfigureNavigationServices();
ConfigureAutoApiControllers();
ConfigureSwaggerServices(context.Services);
ConfigureTheme();
Configure<PermissionManagementOptions>(options =>
{
options.IsDynamicPermissionStoreEnabled = true;
});
Configure<AbpLayoutHookOptions>(options =>
{
options.Add(
LayoutHooks.Head.Last, //The hook name
typeof(DevExtremeJsViewComponent) //The component to add
);
options.Add(
LayoutHooks.Head.Last,
typeof(ChanelJsViewComponent)
);
});
Configure<SettingManagementPageOptions>(options =>
{
options.Contributors.Add(new CalendarSettingsPageContributor());
options.Contributors.Add(new DeskReservationSettingsPageContributor());
options.Contributors.Add(new PlanningSettingsPageContributor());
options.Contributors.Add(new TradeSettingsPageContributor());
});
context.Services.AddSameSiteCookiePolicy(); // cookie policy to deal with temporary browser incompatibilities
context.Services.AddNotyf(config =>
{
config.DurationInSeconds = 8;
config.IsDismissable = true;
config.Position = NotyfPosition.TopCenter;
});
}
private void ConfigureCookieConsent(ServiceConfigurationContext context)
{
context.Services.AddAbpCookieConsent(options =>
{
options.IsEnabled = true;
options.CookiePolicyUrl = "/CookiePolicy";
options.PrivacyPolicyUrl = "/PrivacyPolicy";
});
}
private void ConfigureTheme()
{
Configure<LeptonXThemeOptions>(options =>
{
options.DefaultStyle = LeptonXStyleNames.System;
});
Configure<LeptonXThemeMvcOptions>(options =>
{
options.ApplicationLayout = LeptonXMvcLayouts.SideMenu;
});
}
private void ConfigureHealthChecks(ServiceConfigurationContext context)
{
//context.Services.AddCalendarHealthChecks();
}
private void ConfigureBundles()
{
Configure<AbpBundlingOptions>(options =>
{
options.StyleBundles.Configure(
LeptonXThemeBundles.Styles.Global,
bundle =>
{
bundle.AddFiles("/global-styles.css");
}
);
options.ScriptBundles.Configure(
LeptonXThemeBundles.Scripts.Global,
bundle =>
{
bundle.AddFiles("/global-scripts.js");
}
);
options
.StyleBundles
.Get(StandardBundles.Styles.Global)
.AddContributors(typeof(DevExtremeStyleContributor));
options
.StyleBundles
.Get(StandardBundles.Styles.Global)
.AddContributors(typeof(CalendarStyleContributor));
});
}
private void ConfigurePages(IConfiguration configuration)
{
Configure<RazorPagesOptions>(options =>
{
options.Conventions.AuthorizePage("/HostDashboard", CalendarPermissions.Dashboard.Host);
});
}
private void ConfigureUrls(IConfiguration configuration)
{
Configure<AppUrlOptions>(options =>
{
options.Applications["MVC"].RootUrl = configuration["App:SelfUrl"];
});
}
private void ConfigureAuthentication(ServiceConfigurationContext context)
{
context.Services.ForwardIdentityAuthenticationForBearer(OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme);
context.Services.Configure<AbpClaimsPrincipalFactoryOptions>(options =>
{
options.IsDynamicClaimsEnabled = true;
});
}
private void ConfigureImpersonation(ServiceConfigurationContext context, IConfiguration configuration)
{
context.Services.Configure<AbpIdentityWebOptions>(options =>
{
options.EnableUserImpersonation = true;
});
context.Services.Configure<AbpAccountOptions>(options =>
{
options.TenantAdminUserName = "admin";
options.ImpersonationUserPermission = IdentityPermissions.Users.Impersonation;
});
}
private void ConfigureAutoMapper()
{
Configure<AbpAutoMapperOptions>(options =>
{
options.AddMaps<CalendarWebModule>();
});
}
private void ConfigureVirtualFileSystem(IWebHostEnvironment hostingEnvironment)
{
Configure<AbpVirtualFileSystemOptions>(options =>
{
options.FileSets.AddEmbedded<CalendarWebModule>();
if (hostingEnvironment.IsDevelopment())
{
options.FileSets.ReplaceEmbeddedByPhysical<CalendarDomainSharedModule>(Path.Combine(hostingEnvironment.ContentRootPath, string.Format("..{0}Chanel.Calendar.Domain.Shared", Path.DirectorySeparatorChar)));
options.FileSets.ReplaceEmbeddedByPhysical<CalendarDomainModule>(Path.Combine(hostingEnvironment.ContentRootPath, string.Format("..{0}Chanel.Calendar.Domain", Path.DirectorySeparatorChar)));
options.FileSets.ReplaceEmbeddedByPhysical<CalendarApplicationContractsModule>(Path.Combine(hostingEnvironment.ContentRootPath, string.Format("..{0}Chanel.Calendar.Application.Contracts", Path.DirectorySeparatorChar)));
options.FileSets.ReplaceEmbeddedByPhysical<CalendarApplicationModule>(Path.Combine(hostingEnvironment.ContentRootPath, string.Format("..{0}Chanel.Calendar.Application", Path.DirectorySeparatorChar)));
options.FileSets.ReplaceEmbeddedByPhysical<CalendarHttpApiModule>(Path.Combine(hostingEnvironment.ContentRootPath, string.Format("..{0}..{0}src{0}Chanel.Calendar.HttpApi", Path.DirectorySeparatorChar)));
options.FileSets.ReplaceEmbeddedByPhysical<CalendarWebModule>(hostingEnvironment.ContentRootPath);
}
});
}
private void ConfigureNavigationServices()
{
Configure<AbpNavigationOptions>(options =>
{
options.MenuContributors.Add(new CalendarMenuContributor());
});
Configure<AbpToolbarOptions>(options =>
{
options.Contributors.Add(new CalendarToolbarContributor());
});
}
private void ConfigureAutoApiControllers()
{
Configure<AbpAspNetCoreMvcOptions>(options =>
{
options.ConventionalControllers.Create(typeof(CalendarApplicationModule).Assembly);
options.ConventionalControllers
.Create(typeof(CalendarApplicationModule).Assembly, opts =>
{
opts.UseV3UrlStyle = true;
});
});
}
private void ConfigureSwaggerServices(IServiceCollection services)
{
services.AddAbpSwaggerGen(
options =>
{
options.SwaggerDoc("v1", new OpenApiInfo { Title = "Calendar API", Version = "v1" });
options.DocInclusionPredicate((docName, description) => true);
options.CustomSchemaIds(type => type.FullName);
}
);
}
private void ConfigureExternalProviders(ServiceConfigurationContext context)
{
context.Services
.AddAuthentication()
.AddOpenIdConnect("Okta", options =>
{
options.Authority = "https://myauthentication.okta.com/oauth2/default";
options.ClientId = context.Configuration["AzureAd:ClientId"];
options.ClientSecret = context.Configuration["AzureAd:ClientSecret"];
options.CallbackPath = context.Configuration["AzureAd:CallbackPath"];
options.ResponseType = OpenIdConnectResponseType.Code;
options.SignInScheme = IdentityConstants.ExternalScheme;
options.SaveTokens = true;
options.MapInboundClaims = false;
options.Scope.Add("openid");
options.Scope.Add("profile");
options.Scope.Add("email");
options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "sub");
options.Events = new OpenIdConnectEvents
{
OnRedirectToIdentityProvider = redirectContext =>
{
redirectContext.ProtocolMessage.RedirectUri = context.Configuration["AzureAd:RedirectToIdentityProviderUri"];
return Task.CompletedTask;
}
};
});
}
public override void OnApplicationInitialization(ApplicationInitializationContext context)
{
var app = context.GetApplicationBuilder();
var env = context.GetEnvironment();
app.UseForwardedHeaders();
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
app.UseAbpRequestLocalization();
if (!env.IsDevelopment())
{
app.UseErrorPage();
app.UseHsts();
}
app.UseAbpCookieConsent();
app.UseCorrelationId();
app.UseRouting();
app.MapAbpStaticAssets();
app.UseAbpStudioLink();
app.UseAbpSecurityHeaders();
app.UseAuthentication();
app.UseAbpOpenIddictValidation();
if (MultiTenancyConsts.IsEnabled)
{
app.UseMultiTenancy();
}
app.UseUnitOfWork();
app.UseDynamicClaims();
app.UseAuthorization();
app.UseSwagger();
app.UseAbpSwaggerUI(options =>
{
options.SwaggerEndpoint("/swagger/v1/swagger.json", "Calendar API");
});
app.UseAuditing();
app.UseAbpSerilogEnrichers();
app.UseNotyf();
app.UseConfiguredEndpoints();
}
}
f you need the log, let me know how to send it, as it's too large to paste here.
Best regards,
Stefano
Hi, my application, which runs in Azure, doesn't display icons on some pages Looking with Chrome's DevTools, I see these reports:
The same problem does not occur in development environment.
This is how it should look:
And this is what you see in Azure:
Please note that those icons are the free font awesome icons found in the ABP solution template
Can you tell me how to fix this? Thanks
Hi,
I converted my web application running on Azure from version 4.3 to version 9.3.6 of Abp.io. I'm having an issue with AAD authentication, which doesn't seem to work as it used to. The problem is that once authenticated the redirect on the main page shows a 502 error
This is the code I use for authentication:
private void ConfigureExternalProviders(ServiceConfigurationContext context)
{
context.Services.AddAuthentication()
.AddOpenIdConnect("AzureOpenId", "Azure Active Directory OpenId", options =>
{
options.Authority = "https://login.microsoftonline.com/" + context.Configuration["AzureAd:TenantId"] + "/v2.0/";
options.ClientId = context.Configuration["AzureAd:ClientId"];
options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
options.CallbackPath = context.Configuration["AzureAd:CallbackPath"];
options.ClientSecret = context.Configuration["AzureAd:ClientSecret"];
options.RequireHttpsMetadata = false;
options.SaveTokens = true;
options.GetClaimsFromUserInfoEndpoint = true;
options.SignInScheme = IdentityConstants.ExternalScheme;
options.Scope.Add("email");
options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "sub");
if (context.Services.GetHostingEnvironment().IsProduction())
{
options.Events = new OpenIdConnectEvents
{
OnRedirectToIdentityProvider = redirectContext =>
{
redirectContext.ProtocolMessage.RedirectUri = context.Configuration["AzureAd:RedirectToIdentityProviderUri"];
return Task.CompletedTask;
}
};
}
});
}
The configuration parameters are exactly the same as those in version 4.3. What could be the problem? Where can I investigate?
