Blazor Server Side + Apache + Azure AD

Question

I'm integrating Azure AD into a server side blazor application. It works locally (using https), however when I deploy it to production, the redirect URI in the URL is HTTP, not HTTPS, which then once I log in, Microsoft say the redirect URI isn't valid.

I'm running a VM using Ubuntu and Apache, which is forwarding anything from port 80 to port 443 using a Lets Encrypt certificate, however when it sends the user to Microsoft to login, the redirect URI is http://mydomain.tld, rather than https://mydomain.tld. I think it's because the URL it's running on locally is http://localhost:9000 - But when I put it to https://localhost:9000, it throws an exception on start up as it doesn't have a certificate and as I'm not running on a development machine, I don't really want to install the net core SDK and create dev certificate.

I've seen a few people put this in their code to solve it, however my requests are still going through to Azure AD with a HTTP redirect URI:

 var fordwardedHeaderOptions = new ForwardedHeadersOptions     
{         
ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto     
};     
fordwardedHeaderOptions.KnownNetworks.Clear();     
fordwardedHeaderOptions.KnownProxies.Clear();      
app.UseForwardedHeaders(fordwardedHeaderOptions);

Any ideas on how to fix it? I can't imagine I'm the first to be using Blazor behind Apache and connecting via openid.

I'm not sure about the complications added by Apache and port forwarding, but from an AzureAD perspective they say The redirect URI must begin with the scheme https. There are some exceptions for localhost redirect URIs.... so you will need an httpswhen you go to use it with your mydomain.tld. That's at least one of your problems. — JeremyW
For the redirect URL, it should start with https, if you need to start with http, you must configure it as http://localhost. — Carl Zhao
Yeah - I think the problem is because locally (on the production server), it's running under http, with a proxy from apache redirecting traffic from https to the kestrel server. If I run the kestrel server as https, it exceptions as there's no certificate to bind to. I think I just need to bind to a SSL certificate in production. — Dan

Chauncy Zhou Chauncy Zhou · Accepted Answer · 2020-11-05T08:49:11

0

votes

Two options:

1.Set up Redirect URIs: http://localhost/****

2.Edit the Manifest like below:

Blazor Server Side + Apache + Azure AD

1 Answers