Hi,
Thank you so much for your prompt support. It works now.
I use HTTP not HTTPS. In AdministrationService, it has the same setting and work fine (no need HTTPS).
"AuthServer": {
"Authority": "http://authserver:7000",
"RequireHttpsMetadata": "false",
"SwaggerClientId": "WebGateway_Swagger.DockerHttp"
},
"RemoteServices": {
"AbpIdentity": {
"BaseUrl": "http://identityservice.httpapi.host:7002/",
"UseCurrentAccessToken": "false"
}
},
"IdentityClients": {
"Default": {
"GrantType": "client_credentials",
"ClientId": "AdministrationService.DockerHttp",
"ClientSecret": "1q2w3e*",
"Authority": "http://authserver:7000",
"Scope": "IdentityService"
}
},
Steps to reproduce the issue: I'm using Quartz background worker to call an authorized app service method with above error. Here's appsettings.json:
"RemoteServices": {
"MyService": {
"BaseUrl": "http://myservice.httpapi.host:7005/",
"UseCurrentAccessToken": "false"
}
},
"IdentityClients": {
"Default": {
"GrantType": "client_credentials",
"ClientId": "BackgroundWorker.DockerHttp",
"ClientSecret": "1q2w3e*",
"Authority": "http://authserver:7000",
"Scope": "MyService"
}
}
[DependsOn(
typeof(AbpAutofacModule),
typeof(AbpBackgroundWorkersQuartzModule),
typeof(AbpHttpClientIdentityModelWebModule),
typeof(AbpIdentityHttpApiClientModule),
...
)]
public class BackgroundWorkerModule : AbpModule
{
public override Task OnApplicationInitializationAsync(ApplicationInitializationContext context)
{
var logger = context.ServiceProvider.GetRequiredService<ILogger<BackgroundWorkerModule>>();
var configuration = context.ServiceProvider.GetRequiredService<IConfiguration>();
logger.LogInformation($"MySettingName => {configuration["MySettingName"]}");
var hostEnvironment = context.ServiceProvider.GetRequiredService<IHostEnvironment>();
logger.LogInformation($"EnvironmentName => {hostEnvironment.EnvironmentName}");
return Task.CompletedTask;
}
}
OpenIdDictDataSeeder.cs
//Background Worker
await CreateApplicationAsync(
name: "BackgroundWorker.DockerHttp",
type: OpenIddictConstants.ClientTypes.Confidential,
consentType: OpenIddictConstants.ConsentTypes.Implicit,
displayName: "Background Worker",
secret: "1q2w3e*",
grantTypes: new List<string>
{
OpenIddictConstants.GrantTypes.ClientCredentials
},
scopes: commonScopes.Union(new[] { "MyService" }).ToList(),
permissions: new List<string> { MyServicePermissions.TransactionReports.Default, MyServicePermissions.TransactionReports.GenerateFile }
);
How can I fix it? Thank you.
The escape character is added automatically when I copy and paste and then format it with code block. I saw the docker compose file of application template, it's the same as the one I created for microservice template. The problem is I can't trust the self-sign certificate which generated for each service domain name. Could you pls try to create a test app based on microservice template and configure docker compose for it to reproduce my issue?
Hi,
No more information?
Any update, pls?
I used host file to map like this: 127.0.0.1 mydomain.webgateway As you can see in my docker compose file:
volumes:
- ~/.aspnet/https:/https:ro
Is that correct way to map certificate file? I can see all mapped pfx files in https folder of the container.
I already generated pfx file with this command: New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -DnsName "mydomain.webgateway" -FriendlyName "mydomain.webgateway" -NotAfter (Get-Date).AddYears(10) (because the URL is not localhost, they are container names instead), added to Trusted Root Certification Authorities on Local Machine and mounted successfully, but the error still occurs.
For linux, pfx is problematic as far as i know. You can use OpenSSL to generate self-signed certificate.
Do you mean linux for host or container? I use Windows host but linux container. Do I have to use OpenSSL to generate certificate? If yes, how to use that certificate in docker-compose file?
version: '3.4'
services:
mydomain.authserver:
environment:
\- ASPNETCORE\_ENVIRONMENT=Development
\- ASPNETCORE\_URLS=https://\+:7000
\- ASPNETCORE\_Kestrel\_\_Certificates\_\_Default\_\_Path=/https/mydomain\.authserver\.pfx
\- ASPNETCORE\_Kestrel\_\_Certificates\_\_Default\_\_Password=
ports:
\- "7000:7000"
volumes:
\- \~/\.aspnet/https:/https:ro
\- $\{APPDATA\}/Microsoft/UserSecrets:/root/\.microsoft/usersecrets:ro
mydomain.web:
environment:
\- ASPNETCORE\_ENVIRONMENT=Development
\- ASPNETCORE\_URLS=https://\+:7004
\- ASPNETCORE\_Kestrel\_\_Certificates\_\_Default\_\_Path=/https/mydomain\.web\.pfx
\- ASPNETCORE\_Kestrel\_\_Certificates\_\_Default\_\_Password=
ports:
\- "7004:7004"
volumes:
\- \~/\.aspnet/https:/https:ro
\- $\{APPDATA\}/Microsoft/UserSecrets:/root/\.microsoft/usersecrets:ro
mydomain.webgateway:
environment:
\- ASPNETCORE\_ENVIRONMENT=Development
\- ASPNETCORE\_URLS=https://\+:7500
\- ASPNETCORE\_Kestrel\_\_Certificates\_\_Default\_\_Path=/https/mydomain\.webgateway\.pfx
\- ASPNETCORE\_Kestrel\_\_Certificates\_\_Default\_\_Password=
ports:
\- "7500:7500"
volumes:
\- \~/\.aspnet/https:/https:ro
\- $\{APPDATA\}/Microsoft/UserSecrets:/root/\.microsoft/usersecrets:ro
appsettings.json for Web project
{
"App": {
"SelfUrl": "[https://mydomain.web:7004"](https://mydomain.web:7004%22)
},
"AuthServer": {
"Authority": "[https://mydomain.authserver:7000"](https://mydomain.authserver:7000%22),
"RequireHttpsMetadata": "true",
"ClientId": "Web.Docker",
"ClientSecret": "1q2w3e\*",
"IsOnK8s": "false",
"MetaAddress": "[https://mydomain.authserver:7000"](https://mydomain.authserver:7000%22)
},
"Logging": {
"LogLevel": {
"Default": "Information",
"Microsoft": "Warning",
"Microsoft.Hosting.Lifetime": "Information"
}
},
"AllowedHosts": "\*",
"RemoteServices": {
"Default": {
"BaseUrl": "https:/mydomain.webgateway:7500"
}
}
}
I tried to add above pfx files to Trusted Root on my machine and the guide here: https://ubuntu.com/server/docs/security-trust-store but it didn't work. Pls help