DiscoveryClient.GetAsync fails “Issuer name does not match authority” when call passes through SSL-terminator

user_1021742 0
Viewed 2735

Our web applications are hosted behind an SSL-terminating cluster. I call DiscoveryClient.GetAsync

var discoveryClient = DiscoveryClient.GetAsync("https://ourcluster.net/identityserver").Result;

And I get the following result:

Issuer name does not match authority: http://ourcluster.net/identityserver

I am assuming that the SSL-termination causes the IdentityServer endpoint to receive the request as http and thus it resolves its authority url accordingly.

Any suggestions on how to work around this?

-S

identityserver4 ssl c#
2 Answers

This situation arises because the http request goes from the reverse proxy that is in ssl termination state. So the request goes as https on the proxy and next goes to IdentityServer4 as http.

First, in the IdentityServer you must use MS headers middleware as @leastprivilege said. You can use this snippet from "Microsoft.AspNetCore.HttpOverrides" package.

using Microsoft.AspNetCore.HttpOverrides;
....
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    ...
    // UseForwardedHeaders must be BEFORE the UseIdentityServer.
    app.UseForwardedHeaders(new ForwardedHeadersOptions
    {
        ForwardedHeaders = ForwardedHeaders.XForwardedProto
    });
    app.UseIdentityServer();
}

And second config your reverse proxy to send X-Forwarded-Proto to upstream. We use nginx, so the minimum configuration must be:

server {
    listen 80;
    listen [::]:80;
    listen 443 default_server ssl;

    root /var/www;

    server_name id.example.com;

    ssl on;
    ssl_certificate    /opt/certs/2017/identity-server/fullchain.pem;
    ssl_certificate_key   /opt/certs/2017/identity-server/privkey.pem;

    access_log /var/log/nginx/id.example.com-access.log main;
    error_log  /var/log/nginx/id.example.com-error.log;

    location / {
            proxy_pass http://identity-service;
            proxy_set_header        X-Real-IP       $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header        X-Forwarded-Proto $scheme;
            proxy_set_header Host $host;
            proxy_redirect off;
    }
}
user_20477880
Related