ssl - 在 AWS 中调用 IdentityServer4 时获取 "IDX10108: The address specified is not valid as per HTTPS scheme"

Question

我们已经使用 IdentityServer4 实现了一个身份服务器并将其部署到 AWS。在我们在 ELB 上启用 https 之前，它工作得很好。现在，当客户端尝试进行身份验证时，我们会收到以下错误:

Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[0]
  An unhandled exception has occurred while executing the request
System.InvalidOperationException: IDX10803: Unable to obtain configuration from: 'https://int.mycompany.com/.well-known/openid-configuration'. ---> System.ArgumentException: IDX10108: The address specified is not valid as per HTTPS scheme. Please specify an https address for security reasons. If you want to test with http address, set the RequireHttps property  on IDocumentRetriever to false.

据我了解，客户对证书不满意。这可能与身份服务器的主机名和证书中的名称有关。我们有主题为“*.mycompany.com”的有效通配符证书。我们将具有权限的客户端配置为“https://int.mycompany.com”，这样看起来是一致的。

我还在这些负载平衡配置中读到，一些 header 必须转发到中间件，但我不确定它是如何工作的。

Answer 1

HTTPS 请求似乎无法被识别。尝试将以下设置添加到 Startup 类的 ConfigureServices 方法中:

services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedProto;
});

来自 HTTP Headers and Elastic Load Balancing AWS 文档:

The X-Forwarded-Proto request header helps you identify the protocol (HTTP or HTTPS) that a client used to connect to your server. Your server access logs contain only the protocol used between the server and the load balancer; they contain no information about the protocol used between the client and the load balancer. To determine the protocol used between the client and the load balancer, use the X-Forwarded-Proto request header. Elastic Load Balancing stores the protocol used between the client and the load balancer in the X-Forwarded-Proto request header and passes the header along to your server.