IDX10638 when running Mac OS #6402

5 Answer(s)

• 

  0

  liangshiwei created 4 months ago

  Support Team Fullstack Developer

  Hi,

  This is a certificate problem, could you share the AuthModule.cs code?

  Save Cancel
• 

  0

  carl.hallqvist created 4 months ago

  Hi Liang,

  Sure here it is:

  using System;
  using System.Collections.Generic;
  using System.IO;
  using System.Linq;
  using System.Security.Cryptography.X509Certificates;
  using Microsoft.AspNetCore.Authentication.Google;
  using Microsoft.AspNetCore.Builder;
  using Microsoft.AspNetCore.Cors;x
  using Microsoft.AspNetCore.DataProtection;
  using Microsoft.Extensions.DependencyInjection;
  using Microsoft.Extensions.DependencyInjection.Extensions;
  using Microsoft.Extensions.Hosting;
  using Microsoft.AspNetCore.Authentication.MicrosoftAccount;
  using Microsoft.AspNetCore.Authentication.Twitter;
  using Microsoft.AspNetCore.Hosting;
  using Microsoft.Extensions.Configuration;
  using GeoTicket.AdministrationService.EntityFrameworkCore;
  using GeoTicket.IdentityService.EntityFrameworkCore;
  using GeoTicket.SaasService.EntityFrameworkCore;
  using GeoTicket.Shared.Hosting.AspNetCore;
  using OpenIddict.Server.AspNetCore;
  using Prometheus;
  using StackExchange.Redis;
  using Volo.Abp;
  using Volo.Abp.Account;
  using Volo.Abp.Account.Public.Web.ExternalProviders;
  using Volo.Abp.Account.Web;
  using Volo.Abp.AspNetCore.Mvc.UI.Bundling;
  using Volo.Abp.AspNetCore.Mvc.UI.Theme.LeptonX;
  using Volo.Abp.AspNetCore.Mvc.UI.Theme.LeptonX.Bundling;
  using Volo.Abp.AspNetCore.Mvc.UI.Theme.Shared;
  using Volo.Abp.Auditing;
  using Volo.Abp.BackgroundJobs.RabbitMQ;
  using Volo.Abp.Caching;
  using Volo.Abp.Caching.StackExchangeRedis;
  using Volo.Abp.Emailing;
  using Volo.Abp.EventBus.RabbitMq;
  using Volo.Abp.LeptonX.Shared;
  using Volo.Abp.Modularity;
  using Volo.Abp.MultiTenancy;
  using Volo.Abp.OpenIddict;
  using Volo.Abp.UI.Navigation.Urls;
  using Volo.Abp.VirtualFileSystem;
  
  namespace GeoTicket.AuthServer;
  
  [DependsOn(
      typeof(AbpCachingStackExchangeRedisModule),
      typeof(AbpEventBusRabbitMqModule),
      typeof(AbpBackgroundJobsRabbitMqModule),
      typeof(AbpAspNetCoreMvcUiLeptonXThemeModule),
      typeof(AbpAccountPublicWebOpenIddictModule),
      typeof(AbpAccountPublicApplicationModule),
      typeof(AbpAccountPublicHttpApiModule),
      typeof(AdministrationServiceEntityFrameworkCoreModule),
      typeof(IdentityServiceEntityFrameworkCoreModule),
      typeof(SaasServiceEntityFrameworkCoreModule),
      typeof(GeoTicketSharedHostingAspNetCoreModule),
      typeof(GeoTicketSharedLocalizationModule)
  )]
  public class GeoTicketAuthServerModule : AbpModule
  {
      public override void PreConfigureServices(ServiceConfigurationContext context)
      {
          var hostingEnvironment = context.Services.GetHostingEnvironment();
          var configuration = context.Services.GetConfiguration();
  
          PreConfigure<OpenIddictBuilder>(builder =>
          {
              builder.AddValidation(options =>
              {
                  options.AddAudiences("AccountService");
                  options.UseLocalServer();
                  options.UseAspNetCore();
              });
          });
  
          if (!hostingEnvironment.IsDevelopment())
          {
              PreConfigure<AbpOpenIddictAspNetCoreOptions>(options =>
              {
                  options.AddDevelopmentEncryptionAndSigningCertificate = false;
              });
  
              PreConfigure<OpenIddictServerBuilder>(builder =>
              {
                  builder.AddSigningCertificate(GetSigningCertificate(hostingEnvironment, configuration));
                  builder.AddEncryptionCertificate(GetSigningCertificate(hostingEnvironment, configuration));
                  builder.SetIssuer(new Uri(configuration["AuthServer:Authority"]));
              });
          }
      }
  
      public override void ConfigureServices(ServiceConfigurationContext context)
      {
          var hostingEnvironment = context.Services.GetHostingEnvironment();
          var configuration = context.Services.GetConfiguration();
  
          if (!Convert.ToBoolean(configuration["App:DisablePII"]))
          {
              Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;
          }
  
          if (!Convert.ToBoolean(configuration["AuthServer:RequireHttpsMetadata"]))
          {
              Configure<OpenIddictServerAspNetCoreOptions>(options =>
              {
                  options.DisableTransportSecurityRequirement = true;
              });
          }
  
          ConfigureBundles();
          ConfigureSwagger(context, configuration);
          ConfigureSameSiteCookiePolicy(context);
          ConfigureExternalProviders(context);
  
          Configure<AbpMultiTenancyOptions>(options =>
          {
              options.IsEnabled = true;
          });
  
          Configure<AbpAuditingOptions>(options =>
          {
              options.ApplicationName = "AuthServer";
          });
  
          Configure<AppUrlOptions>(options =>
          {
              options.Applications["MVC"].RootUrl = configuration["App:SelfUrl"];
              options.RedirectAllowedUrls.AddRange(configuration["App:RedirectAllowedUrls"]?.Split(',') ?? Array.Empty<string>());
          });
  
          Configure<AbpDistributedCacheOptions>(options =>
          {
              options.KeyPrefix = "GeoTicket:";
          });
  
          var dataProtectionBuilder = context.Services.AddDataProtection().SetApplicationName("GeoTicket");
          var redis = ConnectionMultiplexer.Connect(configuration["Redis:Configuration"]);
          dataProtectionBuilder.PersistKeysToStackExchangeRedis(redis, "GeoTicket-Protection-Keys");
  
          context.Services.AddCors(options =>
          {
              options.AddDefaultPolicy(builder =>
              {
                  builder
                      .WithOrigins(
                          configuration["App:CorsOrigins"]?
                              .Split(",", StringSplitOptions.RemoveEmptyEntries)
                              .Select(o => o.Trim().RemovePostFix("/"))
                              .ToArray() ?? Array.Empty<string>()
                      )
                      .WithAbpExposedHeaders()
                      .SetIsOriginAllowedToAllowWildcardSubdomains()
                      .AllowAnyHeader()
                      .AllowAnyMethod()
                      .AllowCredentials();
              });
          });
  
  #if DEBUG
          context.Services.Replace(ServiceDescriptor.Singleton<IEmailSender, NullEmailSender>());
  #endif
  
          if (hostingEnvironment.IsDevelopment())
          {
              Configure<AbpVirtualFileSystemOptions>(options =>
              {
                  options.FileSets.ReplaceEmbeddedByPhysical<GeoTicketSharedLocalizationModule>(Path.Combine(
                      hostingEnvironment.ContentRootPath,
                      $"..{Path.DirectorySeparatorChar}..{Path.DirectorySeparatorChar}..{Path.DirectorySeparatorChar}..{Path.DirectorySeparatorChar}shared{Path.DirectorySeparatorChar}GeoTicket.Shared.Localization"));
              });
          }
  
          Configure<LeptonXThemeOptions>(options =>
          {
              options.DefaultStyle = LeptonXStyleNames.System;
          });
      }
  
      public override void OnApplicationInitialization(ApplicationInitializationContext context)
      {
          var app = context.GetApplicationBuilder();
          var env = context.GetEnvironment();
  
          var configuration = context.ServiceProvider.GetRequiredService<IConfiguration>();
  
          app.Use(async (ctx, next) =>
          {
              if (ctx.Request.Headers.ContainsKey("from-ingress"))
              {
                  ctx.Request.Scheme = "https";
              }
  
              await next();
          });
  
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
          }
  
          app.UseAbpRequestLocalization();
  
          if (!env.IsDevelopment())
          {
              app.UseErrorPage();
          }
  
          app.UseCorrelationId();
          app.UseAbpSecurityHeaders();
          app.UseStaticFiles();
          app.UseRouting();
          app.UseCors();
          app.UseCookiePolicy();
          app.UseHttpMetrics();
          app.UseAuthentication();
          app.UseAbpOpenIddictValidation();
          app.UseMultiTenancy();
          app.UseAbpSerilogEnrichers();
          app.UseUnitOfWork();
          app.UseAuthorization();
          app.UseSwagger();
          app.UseAbpSwaggerUI(options =>
          {
              options.SwaggerEndpoint("/swagger/v1/swagger.json", "Account Service API");
              options.OAuthClientId(configuration["AuthServer:SwaggerClientId"]);
          });
          app.UseAuditing();
          app.UseConfiguredEndpoints(endpoints =>
          {
              endpoints.MapMetrics();
          });
      }
  
      private void ConfigureBundles()
      {
          Configure<AbpBundlingOptions>(options =>
          {
              options.StyleBundles.Configure(
                  LeptonXThemeBundles.Styles.Global,
                  bundle =>
                  {
                      bundle.AddFiles("/global-styles.css");
                  }
              );
          });
      }
  
      private void ConfigureExternalProviders(ServiceConfigurationContext context)
      {
          context.Services.AddAuthentication()
              .AddGoogle(GoogleDefaults.AuthenticationScheme, _ => { })
              .WithDynamicOptions<GoogleOptions, GoogleHandler>(
                  GoogleDefaults.AuthenticationScheme,
                  options =>
                  {
                      options.WithProperty(x => x.ClientId);
                      options.WithProperty(x => x.ClientSecret, isSecret: true);
                  }
              )
              .AddMicrosoftAccount(MicrosoftAccountDefaults.AuthenticationScheme, options =>
              {
                  //Personal Microsoft accounts as an example.
                  options.AuthorizationEndpoint = "https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize";
                  options.TokenEndpoint = "https://login.microsoftonline.com/consumers/oauth2/v2.0/token";
              })
              .WithDynamicOptions<MicrosoftAccountOptions, MicrosoftAccountHandler>(
                  MicrosoftAccountDefaults.AuthenticationScheme,
                  options =>
                  {
                      options.WithProperty(x => x.ClientId);
                      options.WithProperty(x => x.ClientSecret, isSecret: true);
                  }
              )
              .AddTwitter(TwitterDefaults.AuthenticationScheme, options => options.RetrieveUserDetails = true)
              .WithDynamicOptions<TwitterOptions, TwitterHandler>(
                  TwitterDefaults.AuthenticationScheme,
                  options =>
                  {
                      options.WithProperty(x => x.ConsumerKey);
                      options.WithProperty(x => x.ConsumerSecret, isSecret: true);
                  }
              );
      }
  
      private X509Certificate2 GetSigningCertificate(IWebHostEnvironment hostingEnv, IConfiguration configuration)
      {
          var fileName = "authserver.pfx";
          var passPhrase = "6a511cc3-738b-426c-ab04-5d236fe77a1c";
          var file = Path.Combine(hostingEnv.ContentRootPath, fileName);
  
          if (!File.Exists(file))
          {
              throw new FileNotFoundException($"Signing Certificate couldn't found: {file}");
          }
  
          return new X509Certificate2(file, passPhrase);
      }
  
      private void ConfigureSwagger(ServiceConfigurationContext context, IConfiguration configuration)
      {
          SwaggerConfigurationHelper.ConfigureWithAuth(
              context: context,
              authority: configuration["AuthServer:Authority"]!,
              scopes: new Dictionary<string, string> {
                  /* Requested scopes for authorization code request and descriptions for swagger UI only */
                  { "AccountService", "Account Service API" }
              },
              apiTitle: "Account Service API"
          );
      }
  
      private void ConfigureSameSiteCookiePolicy(ServiceConfigurationContext context)
      {
          context.Services.AddSameSiteCookiePolicy();
      }
  }
  

  Save Cancel
• 

  0

  liangshiwei created 4 months ago

  Support Team Fullstack Developer

  Hi,

  You can try to generate a new certificate to replace the old one.

  dotnet dev-certs https -v -ep authserver.pfx -p GUID....

  private X509Certificate2 GetSigningCertificate(IWebHostEnvironment hostingEnv, IConfiguration configuration)
  {
      var fileName = "authserver.pfx";
      var passPhrase = "GUID....";
      var file = Path.Combine(hostingEnv.ContentRootPath, fileName);
  
      if (!File.Exists(file))
      {
          throw new FileNotFoundException($"Signing Certificate couldn't found: {file}");
      }
  
      return new X509Certificate2(file, passPhrase);
  }
  

  Save Cancel
• 

  0

  maliming created 4 months ago

  Support Team Fullstack Developer

  hi

  try to use your authserver.pfx

  Please use dotnet dev-certs https -v -ep authserver.pfx -p 6a511cc3-738b-426c-ab04-5d236fe77a1c command to generate the pfx file if there is no such file.

  public override void PreConfigureServices(ServiceConfigurationContext context)
  {
      var hostingEnvironment = context.Services.GetHostingEnvironment();
      var configuration = context.Services.GetConfiguration();
  
      PreConfigure(builder =>
      {
          builder.AddValidation(options =>
          {
              options.AddAudiences("AccountService");
              options.UseLocalServer();
              options.UseAspNetCore();
          });
      });
  
      PreConfigure(options =>
      {
          options.AddDevelopmentEncryptionAndSigningCertificate = false;
      });
  
      PreConfigure(builder =>
      {
          builder.AddSigningCertificate(GetSigningCertificate(hostingEnvironment, configuration));
          builder.AddEncryptionCertificate(GetSigningCertificate(hostingEnvironment, configuration));
          builder.SetIssuer(new Uri(configuration["AuthServer:Authority"]));
      });
  }
  
  

  Save Cancel
• 

  0

  carl.hallqvist created 4 months ago

  It works. It was just to remove the certificate in the keyring, and create a new one. Don't understand why this happened.

  dotnet dev-certs https --trust

  Thanks, Carl

  Save Cancel