Search code examples
asp.net-coreidentityserver4

asp.net core identity Server 4 only one of three custom domain accepted for requests

I followed this guide to setup my asp.net hosted blazor wasm project and I was able to setup everything so that I have multiple custom domains which all are considered to have a valid ssl certificate and that I was able to login to all of them. The HTTPS certificate was generated as a Azure App Service managed certificate. The one for IS4 was generated via Azure Key Vault.

The strange thing then is, that from the now 3 domains only one is able to make actual requests to an endpoint. For the others I get this exception:

www-authenticate: Bearer error="invalid_token", error_description="The issuer '[Domain]' is invalid" Funny enough it seems that it is pretty much random which of the domains is the valid one. After a restart that can change again. For reproduction I created a new project in visual studio with individual authentication and deployed it to a new azure app service, and added two new domains. So I have now 3 again:

  • foo.apply-solutions.ch
  • foo.apply-solutions.com
  • blazorapp1server20201008191519.azurewebsites.net

As of this writing the .ch address is the one who is able to make requests. For the two others, when moving to the Fetch Data page, there is just an in the console. My suspicion is, that after a restart the domain who makes the first request works and the others don't.

The signing certificate is created with this settings:

image

And I load it via the WEBSITE_LOAD_CERTIFICATES configuration. I also attach the solution I uploaded to azure, although it is only minimal adjusted to apply migrations during startup.

You can find a example under this link (it links to a github issue I opened to this topic in the ASPNetCore Documentation Repository: https://github.com/dotnet/AspNetCore.Docs/files/5350494/BlazorApp1.zip

Solution

  • You can set the IssuerUri in the IdentityServer options, see this page for details:

    https://identityserver4.readthedocs.io/en/latest/reference/options.html

    You should only have one issuer in the system, otherwise it will be confusing...

    In azure one issue is that you might have a public domain that the public clients see, but internally the service itself sees an internal domain namn. Especially common if you terminate HTTPS/TLS outside your application. I think its ok to set the IssuerUri to the public domain name that clients use to communicate with it.