c# - 无法从 : 'https://ids.com/.well-known/openid-configuration' 检索文档

Question

我一直在开发多个依赖 Identity Server 4(IDS4) 使用 OIDC 进行身份验证的应用程序。一切都很好，直到我使用 SSL 卸载将应用程序置于代理之后。

目标是能够访问一个站点。当您请求登录时，它应该将您重定向到 IDS4 验证您，然后将您送回。这是标准的..

到底发生了什么。 403 错误:

An unhandled exception occurred while processing the request.
HttpRequestException: Response status code does not indicate success: 403 (Forbidden).
System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
IOException: IDX20804: Unable to retrieve document from: 'https://ids.com/.well-known/openid-configuration'.
Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(string address, CancellationToken cancel)
InvalidOperationException: IDX20803: Unable to obtain configuration from: 'https://ids.com/.well-known/openid-configuration'.
Microsoft.IdentityModel.Protocols.ConfigurationManager<T>.GetConfigurationAsync(CancellationToken cancel)
Stack Query Cookies Headers 
HttpRequestException: Response status code does not indicate success: 403 (Forbidden).
System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(string address, CancellationToken cancel)

    Show raw exception details 
IOException: IDX20804: Unable to retrieve document from: 'https://ids.com/.well-known/openid-configuration'.
Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(string address, CancellationToken cancel)
Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(string address, IDocumentRetriever retriever, CancellationToken cancel)
Microsoft.IdentityModel.Protocols.ConfigurationManager<T>.GetConfigurationAsync(CancellationToken cancel)

Show raw exception details 
InvalidOperationException: IDX20803: Unable to obtain configuration from: 'https://ids.com/.well-known/openid-configuration'.
Microsoft.IdentityModel.Protocols.ConfigurationManager<T>.GetConfigurationAsync(CancellationToken cancel)
Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleChallengeAsync(AuthenticationProperties properties)
Microsoft.AspNetCore.Authentication.AuthenticationHandler<TOptions>.ChallengeAsync(AuthenticationProperties properties)
Microsoft.AspNetCore.Authentication.AuthenticationService.ChallengeAsync(HttpContext context, string scheme, AuthenticationProperties properties)
Microsoft.AspNetCore.Mvc.ChallengeResult.ExecuteResultAsync(ActionContext context)
Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeResultAsync(IActionResult result)
Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAlwaysRunResultFilters()
Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeFilterPipelineAsync()
Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.InvokeAsync()
Microsoft.AspNetCore.Builder.RouterMiddleware.Invoke(HttpContext httpContext)
Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)
Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

出于好奇，我关闭了我的 IDS 应用程序并尝试通过我的其他应用程序之一访问它，但得到了完全相同的错误响应。这让我相信这与使用 openidc 时我的应用程序中的代码或我的 IIS 设置有关。

注意事项: 我正在使用 IIS。 我的代理站点上有受信任的 CA 证书。 假设 IDS 正在运行，我可以访问“https://ids.com/.well-known/openid-configuration” ' 在我的浏览器中。你不会的，这是一个假域名。

我尝试过的事情:

1. OpenIdConnect 内部尝试将 RequireHttpsMetadata 从假到真，

2. app.UseForwardedHeaders();

好吧，我在这里肯定是错的，但我认为问题是我的应用程序(使用 OIDC 时)没有发送禁止它们访问 'https://ids.com/.well-know 的 SSL 信息。 '地址。

我应该从哪里开始尝试使用它？

我的一些启动代码:

    services.Configure<ForwardedHeadersOptions>(options =>
            {
                options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
                options.RequireHeaderSymmetry = false;
                options.KnownNetworks.Clear();
                options.KnownProxies.Clear();

            });

    .AddOpenIdConnect(AuthorizationConsts.OidcAuthenticationScheme, options =>
     {

         options.SignInScheme = "Cookies";
         options.Authority = "https://ids.com";
         options.RequireHttpsMetadata = true;
         options.ClientId = AuthorizationConsts.OidcClientId;


         options.Scope.Clear();
         options.Scope.Add(AuthorizationConsts.ScopeOpenId);
         options.Scope.Add(AuthorizationConsts.ScopeProfile);
         options.Scope.Add(AuthorizationConsts.ScopeEmail);
         options.Scope.Add(AuthorizationConsts.ScopeRoles);



         options.SaveTokens = true;

         options.TokenValidationParameters = new TokenValidationParameters
         {
             NameClaimType = JwtClaimTypes.Name,
             RoleClaimType = JwtClaimTypes.Role,
         };

         options.Events = new OpenIdConnectEvents
         {
             OnMessageReceived = OnMessageReceived,
             OnRedirectToIdentityProvider = OnRedirectToIdentityProvider

         };
     });

..............


    app.Use(async (Context, next) =>
           {
               if (!string.IsNullOrEmpty(Context.Request.Headers["X-ARR-SSL"]))
               {
                   Context.Request.Scheme = "https";
                   await next.Invoke();

               }
               else
               {
                   Context.Request.Scheme = "http";
                   await next.Invoke();
               }

           });

            app.UseForwardedHeaders();

            // Ensures we can serve static-files that should not be processed by ASP.NET
            app.UseStaticFiles();

            // Enable the authentication middleware so we can protect access to controllers and/or actions
            app.UseAuthentication();

Answer 1

对我来说，问题通过添加解决了

ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12