nginx - ASP.NET Core 2.0，Kubernetes，https缺少回复地址吗？

Question

我有一个部署到Kubernetes集群的ASP.NET Core 2.0 Web应用程序。该应用程序使用Azure AD对某些 protected 页面进行身份验证。 Kubernetes集群是使用Nginx入口 Controller 设置的，让我们加密以支持https。

我可以毫无问题地访问https://x.eastus.cloudapp.azure.com，也可以单击我定向到https://x.eastus.cloudapp.azure.com/link的网站上的链接，也没有问题。

但是，当我单击需要登录用户的链接时，会得到:

Sign in
Sorry, but we’re having trouble signing you in.

AADSTS50011: The reply address 'http://x.eastus.cloudapp.azure.com/signin-oidc' does not match the reply addresses configured for the application: 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx'. More details: not specified

请注意，上面的URL缺少https，这就是问题所在。

我已经在Azure AD中将“ https://x.eastus.cloudapp.azure.com/signin-oidc”注册为该应用程序的回复URL。

但是，我不明白为什么登录时使用的回复URL缺少https。

如果将完全相同的应用程序部署到Azure Web App，则不会出现此问题。

可能是什么问题？

这是我的Ingress YAML文件:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: x-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    # Add to generate certificates for this ingress
    kubernetes.io/tls-acme: 'true'
spec:
  rules:
    - host: x.eastus.cloudapp.azure.com
      http:
        paths:
          - path: /
            backend:
              serviceName: x-service
              servicePort: 80
  tls:
    # With this configuration kube-lego will generate a secret called `x-tls-secret`
    # for the URL `x.eastus.cloudapp.azure.com`
    - hosts:
        - "x.eastus.cloudapp.azure.com"
      secretName: x-tls-secret

我在Startup.cs中有以下代码:

public void ConfigureServices(IServiceCollection services)
{
    services.Configure<ForwardedHeadersOptions>(options =>
    {
        options.ForwardedHeaders =
            ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    });

    services.Configure<MvcOptions>(options =>
    {
        options.Filters.Add(new RequireHttpsAttribute());
    });

    services.AddAuthentication(sharedOptions =>
    {
        sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        sharedOptions.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
    })
    .AddAzureAd(options => Configuration.Bind("AzureAd", options))
    .AddCookie();

    services.AddMvc();
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseForwardedHeaders();

    app.UseStaticFiles();

    app.UseAuthentication();
}

Answer 1

在Configure方法中添加自定义中间件以执行手动http-https重定向

app.Use(async (context, next) =>
{
    if (context.Request.IsHttps || context.Request.Headers["X-Forwarded-Proto"] == Uri.UriSchemeHttps)
    {
        await next();
    }
    else
    {
        string queryString = context.Request.QueryString.HasValue ? context.Request.QueryString.Value : string.Empty;
        var https = "https://" + context.Request.Host + context.Request.Path + queryString;
        context.Response.Redirect(https);
    }
});