Question

我在负载均衡器后面遇到IdentityServer的问题，
为了清楚我是否使用直接ips，evertything按预期工作。

目前我在LB上有一个SSL配置，其中包含一个有效的证书，可以重定向到两台Linux机器上托管的HTTP docker-engines。

我在客户端使用MVC混合流程：

app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
{
    AuthenticationScheme = "oidc",
    SignInScheme = "Cookies",
    Authority = settings.Server,
    RequireHttpsMetadata = "false",
    ClientId = "MyMvcClient",
    ClientSecret = "MyMvcSuperPassword",
    ResponseType =  "code id_token",
    GetClaimsFromUserInfoEndpoint = true,
    SaveTokens = true,
    TokenValidationParameters = new TokenValidationParameters
    {
        NameClaimType = JwtClaimTypes.Name,
        RoleClaimType = JwtClaimTypes.Role,
    },
    Events = new OpenIdConnectEvents()
    {
        OnRemoteFailure = context =>
        {
            context.Response.Redirect("/error");
            context.HandleResponse();
            return Task.FromResult(0);
        }
    },
    "Scope": { "openid", "profile", "email", "myclient", "offline_access" }
});

在服务器端，我有以下设置：

public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<IdentityDbContext>(builder);
    services.AddIdentity<ApplicationUser, ApplicationRole>()
        .AddEntityFrameworkStores<IdentityDbContext, Guid>()
        .AddUserStore<UserStore<ApplicationUser, ApplicationRole, IdentityDbContext, Guid>>()
        .AddRoleStore<RoleStore<ApplicationRole, IdentityDbContext, Guid>>()
        .AddUserManager<LdapUserManager>()
        .AddSignInManager<LdapSignInManager>()
        .AddDefaultTokenProviders()
        .AddIdentityServerUserClaimsPrincipalFactory();
    ...
    string redisSettings = $"{redisHost}:{redisPort},ssl={redisSsl},abortConnect={redisAbortConnect},password={redisPassword}";
    services.AddDataProtection().PersistKeysToRedis(redis, redisKey);
    ...
    // Adds IdentityServer
    services.AddIdentityServer()
        .AddSigningCredential(new X509Certificate2("IdentityServerAuth.pfx"))
        .AddConfigurationStore(builder)
        .AddOperationalStore(builder)
        .AddAspNetIdentity<ApplicationUser>()
        .AddProfileService<IdentityProfileService>();
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory, IServiceProvider serviceProvider)
{
    app.UseIdentity();
    app.UseForwardedHeaders(new ForwardedHeadersOptions
    {
        ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
    });
    // Adds IdentityServer
    app.UseIdentityServer();
}

正如我已经提到的，它适用于没有Load Balancer的配置，但客户端失败并出现错误＆＃34;邮件包含错误：＆＃39; invalid_request＆＃39;，error_description：＆＃39; error_description为空＆＃39;，error_uri：＆＃39; error_uri为空＆＃39;。＆＃34;

在服务器端，我收到了 info：IdentityServer4.Hosting.IdentityServerMiddleware [0] 调用IdentityServer端点：/ connect / token的IdentityServer4.Endpoints.TokenEndpoint 警告：IdentityServer4.Endpoints.TokenEndpoint [0] 令牌端点的HTTP请求无效

Answer 1

我已经解决了这个问题。找到的解决方案是跟踪Request.HttpContext.Connection.RemoteIpAddress 它无效，等于负载均衡器的IP。因此解决方案是使用以下方法添加Ip：

options.KnownProxies.Clear();
options.KnownProxies.Add(IPAddress.Parse("LoadBalancer IP"));
app.UseForwardedHeaders(options);

或通过掩码，例如192.168.1.0/8：

options.KnownNetworks.Clear();
options.KnownNetworks.Add(new IPNetwork(IPAddress.Parse("192.168.1.0"), 8));
app.UseForwardedHeaders(options);

在这种情况下，客户端的IP将被传递到身份服务器，您将不会收到异常：

Invalid HTTP request for token endpoint

负载均衡器＆＃34;令牌端点的无效HTTP请求＆＃34;

1 个答案: