Ocelot gateway unable to obtain configuration from identityserver in docker compose

Viewed 657

I have an error that I can't seem to understand why this is happening.

I have a microservice architecture running in a docker network. I'm trying to set up an identity server with the framework Identityserver4.

There is a proxy forwarding to an Ocelot gateway. The client is an angular application.

The login and logout and retrieving the access token and the identity token is successful, but when I try to set up authentication in Ocelot, I get the following error.

DX20803: Unable to obtain configuration from: 'http://identityservice:5010/.well- 
known/openid-configuration'.
gateway_1               | System.InvalidOperationException: IDX20803: Unable to obtain 
configuration from: 'http://identityservice:5010/.well-known/openid-configuration'.
gateway_1               |  ---> System.IO.IOException: IDX20804: Unable to retrieve document 
from: 'http://localhost/auth/.well-known/openid-configuration/jwks'.
gateway_1               |  ---> System.Net.Http.HttpRequestException: Cannot assign 
requested address

The docker-compose is set up in this way

version: '3.0'

services: 
pricecalendarservice:
    build: 
        context: ./PriceCalendarService
    environment: 
        - ASPNETCORE_URLS=http://+:5002
        - RedisConnection=redis
gateway:
    build: 
        context: ./Gateway/
    environment: 
        - ASPNETCORE_URLS=http://+:5000
        - ID_URL=http://identityservice
frontend:
    build:
        context: ./SPA
        dockerfile: staging.dockerfile
itemmanagerservice: 
    build:
        ./ItemManagerService
    environment: 
        - ASPNETCORE_URLS=http://+:5003
        - IdentityUrl=http://identityservice
identityservice:
    build:
        context: ./IdentityServer/IdentityServer
    environment: 
        - DEV_URL=http://localhost
        - ASPNETCORE_ENVIRONMENT=Developmnet
        - ASPNETCORE_URLS=http://+:5010
        - IDENTITY_ISSUER=http://localhost/auth
        - RedisConnection=redis
    ports: 
        - 5010:5010
proxy:
    build:
        context: ./proxy
    ports: 
        - 80:80
redis:
    image: redis
    ports: 
        - 6379:6379

The Identityserver is configured in the following way

   string redisConnectionString = Environment.GetEnvironmentVariable("RedisConnection", 
      EnvironmentVariableTarget.Process);
        string prodEnv = Environment.GetEnvironmentVariable("PROD_URL");
        string devEnv = Environment.GetEnvironmentVariable("DEV_URL");
        string env = Environment.GetEnvironmentVariable("ASPNETCORE_URLS");
        string issuer = Environment.GetEnvironmentVariable("IDENTITY_ISSUER");

        var redis = ConnectionMultiplexer.Connect( redisConnectionString + ":6379");
        services.AddDataProtection()
            .PersistKeysToStackExchangeRedis( redis , "DataProtection-Keys")
            .SetApplicationName("product");
        services.AddCors(o => o.AddPolicy("MyPolicy", builder =>
        {
            builder
                .WithOrigins("https:localhost:4200")
                .AllowAnyMethod()
                .AllowAnyHeader();
        }));


        services.Configure<CookiePolicyOptions>(options =>
        {
            // This lambda determines whether user consent for non-essential cookies is 
      needed for a given request.
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });

        var config = new Config();

        config.setEnvironemnt(devEnv);


        services.AddIdentityServer(options => {
                options.PublicOrigin = issuer;
            })

            .AddDeveloperSigningCredential()
            .AddInMemoryIdentityResources(config.GetIdentityResources())
            .AddInMemoryApiResources(config.GetApis())
            .AddInMemoryClients(config.GetClients())
            .AddTestUsers(config.GetUsers());

NB. the issuer is set to "http://localhost/auth"

The Nginx proxy server is set with the following settings

server {
    listen 80;


    location / {
        proxy_pass       http://frontend;
        proxy_redirect   off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;
    }
        location /api/hub {
        proxy_pass       http://gateway:5000;
        proxy_redirect   off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /api {
        proxy_pass       http://gateway:5000;
        proxy_redirect   off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;
        proxy_set_header Upgrade $http_upgrade;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header Connection "upgrade";
    }


    location /auth {
        proxy_pass       http://gateway:5000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection keep-alive;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }

   }

The gateway configuration is, as read in the documentation at Ocelot Documentation

var authenticationProviderKey = "TestKey";

                s.AddAuthentication()
                .AddIdentityServerAuthentication(authenticationProviderKey, x =>
                    {
                        x.Authority = "http://identityservice:5010";
                        x.RequireHttpsMetadata=false;

                    });
                /*
                options.TokenValidationParameters = new 
   Microsoft.IdentityModel.Tokens.TokenValidationParameters()
                {
                    ValidAudiences = new[] {"item"}
                };
                */

               s.AddOcelot();
               s.AddSwaggerGen(swagger =>
        {
            swagger.SwaggerDoc("v1", new OpenApiInfo { Title = "PriceCalendarService" });
        });

It seems that the gateway, which is running inside the docker network cant get access to the identity server. But I have tried both the URL which the angular is calling which is

"http://localhost/auth"

And also the name of the service running in docker, in multiple ways.

"http://identityservice:5010" 
"http://identityservice"

But somehow, the gateway can't get access to the identity server to load the discovery document.

Can anyone point me in any direction on how to get this right.

0 Answers
Related