运行 Docker ECS Fargate IDX20108 中的 IdentityV4 根据 HTTPS 方案，地址 'System.String' 无效

Question

当授权地址来自 AWS 负载均衡器时，我遇到了问题 HTTPS/SSL。我是 ECS Fargate Docker 中的运行 IdentityServer4，此服务配置为使用 Elastic Load Balancing 来分配流量。创建了一个新的侦听器以使用正确的证书转发 443 端口。我无法将此 https 配置为授权服务器。

客户：

services.AddAuthentication(options =>
    {
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
    })
    .AddCookie(setup => setup.ExpireTimeSpan = TimeSpan.FromHours(2))
    .AddOpenIdConnect(options =>
    {  
        options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.Authority = "https://account-test.mydomain";
        options.ClientId = "WebMVC";
        options.ClientSecret = "mysecret";
        options.ResponseType = "code id_token";
        options.SaveTokens = true;
        options.GetClaimsFromUserInfoEndpoint = true;
        options.RequireHttpsMetadata = true;
        options.Scope.Add(IdentityServerConstants.StandardScopes.Email);
        options.Scope.Add("custom.profile");
        options.TokenValidationParameters = new TokenValidationParameters
        {
            NameClaimType = "name",
            RoleClaimType = "role"
        };
    });

错误：

An unhandled exception occurred while processing the request.
ArgumentException: IDX20108: The address specified 'System.String' is not valid as per HTTPS scheme. Please specify an https address for security reasons. If you want to test with http address, set the RequireHttps property on IDocumentRetriever to false.
Parameter name: address
Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(string address, CancellationToken cancel)

InvalidOperationException: IDX20803: Unable to obtain configuration from: 'System.String'.
Microsoft.IdentityModel.Protocols.ConfigurationManager<T>.GetConfigurationAsync(CancellationToken cancel)

Stack Query Cookies Headers
ArgumentException: IDX20108: The address specified 'System.String' is not valid as per HTTPS scheme. Please specify an https address for security reasons. If you want to test with http address, set the RequireHttps property on IDocumentRetriever to false. Parameter name: address
Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(string address, CancellationToken cancel)
Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(string address, IDocumentRetriever retriever, CancellationToken cancel)
Microsoft.IdentityModel.Protocols.ConfigurationManager<T>.GetConfigurationAsync(CancellationToken cancel)

Show raw exception details
InvalidOperationException: IDX20803: Unable to obtain configuration from: 'System.String'.
Microsoft.IdentityModel.Protocols.ConfigurationManager<T>.GetConfigurationAsync(CancellationToken cancel)
Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleChallengeAsync(AuthenticationProperties properties)
Microsoft.AspNetCore.Authentication.AuthenticationHandler<TOptions>.ChallengeAsync(AuthenticationProperties properties)
Microsoft.AspNetCore.Authentication.AuthenticationService.ChallengeAsync(HttpContext context, string scheme, AuthenticationProperties properties)
Microsoft.AspNetCore.Mvc.ChallengeResult.ExecuteResultAsync(ActionContext context)
Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeResultAsync(IActionResult result)
Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAlwaysRunResultFilters()
Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeFilterPipelineAsync()
Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAsync()
Microsoft.AspNetCore.Routing.EndpointMiddleware.Invoke(HttpContext httpContext)
Microsoft.AspNetCore.Routing.EndpointRoutingMiddleware.Invoke(HttpContext httpContext)
Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)
Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

当我尝试使用 HTTP 作为权限时：“http://account-test.mydomain”它工作正常！

Answer 1

这个问题帮我解决：https://github.com/aspnet/Security/issues/929

解决方案：

包括在 IdentityServer 和客户端使用：

app.Use((context, next) => { 
context.Request.Scheme = "https"; return next(); });

谢谢大家！

Answer 2

我最近在 NGINX 后面的 docker 中托管 IdentityServer 时遇到了类似的问题。我的解决方案是在 Startup.cs ConfigureServices 方法中配置转发的 header 中间件：

services.Configure<ForwardedHeadersOptions>(options =>
{
  options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
  options.ForwardLimit = 2;
  options.KnownNetworks.Clear();
  options.KnownProxies.Clear();
});

并在 Startup.cs 配置方法的其他中间件之前添加它：

app.UseForwardedHeaders();

这确保在使用 docker 时转发 header。

运行 Docker ECS Fargate IDX20108 中的 IdentityV4 根据 HTTPS 方案，地址 'System.String' 无效

Running IdentityV4 in Docker ECS Fargate IDX20108The address 'System.String' is not valid as per HTTPS scheme

docker

https

asp.net-identity

aws-fargate