Running Identity Server 4 behind the proxy

[PieterBoeren]

I was wondering if anyone has ever tried running Identity Server 4 behind the proxy (as a separate service, so not adding it inside the proxy itself) and managed to get it to work, I certainly didn't ;)

I use docker and secure my proxy with a "AddOpenIdConnect", but I can only getting it to work to bypass the proxy and connect to the Identity Server externally (by exposing a different port in my docker configuration). I rather don't expose this directly, but I haven't found a way to do so...

[Tratcher]

What kind of errors are you getting?

I'd expect the standard ASP.NET Proxy guidance to apply.
https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-5.0

[PieterBoeren]

1. When I set the authority to something like "https://localhost:7433/identity" (and add routing/cluster etc), I get "HttpRequestException: Cannot assign requested address (localhost:7443)".
2. When I set the domain to "host.docker.internal", I get SSL issues, since that is no longer running on the development certificate (which makes sense).
3. Switching to non-SSL gives me "InvalidOperationException: IDX20803: Unable to obtain configuration from: 'System.String'."

Since setting the authority with a relative url is not supported, how do I set this to a value which is actually picked up by the proxy?

[PieterBoeren]

I tried some more things this morning, but still got issues. Problem seems to be that the proxy itself is making some calls to the Identity Server, but also redirect me to the login page (which is correct). The thing that seems to be working is when I set the OpenId Authority to my internal docker container name (options.Authority = "http://backend-identityservice";), then I at least get redirected, but only to the name of the docker container, which gives a 404 since that container is not exposed (it is behind the proxy).

I tried changing the issuer urls in IS4, but this gives me even stranger errors, both domains are now in there (browsing to the second one works):

Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
      An unhandled exception has occurred while executing the request.
      System.InvalidOperationException: IDX20803: Unable to obtain configuration from: 'http://backend-identityservice/.well-known/openid-configuration'.
       ---> System.IO.IOException: IDX20804: Unable to retrieve document from: 'https://somedomain:7443/identity/.well-known/openid-configuration/jwks'.
       ---> System.Net.Http.HttpRequestException: Connection refused (somedomain:7443)
       ---> System.Net.Sockets.SocketException (111): Connection refused

Any clues?

[Tratcher]

Sorry, this really is a configuration question for IdentityServer4. Part of the issues is configuring IS4 to work with two urls; 1) the public url for issuers, and 2) the internal url for inter-container communication. You shouldn't need any config changes in the proxy itself.

Here are some issues from IS4 discussing this:
https://stackoverflow.com/questions/44481538/identity-server-4-and-docker
DuendeArchive/IdentityServer4#1623
https://leastprivilege.com/2017/10/09/new-in-identityserver4-v2-simplified-configuration-behind-load-balancers-or-reverse-proxies/
DuendeArchive/IdentityServer4#3966
DuendeArchive/IdentityServer4#5020
DuendeArchive/IdentityServer4#4038