[FIXED] How can I configure IdentityServer4 (DotNet Core) to work in Nginx reverse proxy

Issue

I've published my API, ID server STS and web ui on separate docker containers and I'm using a nginx container to act as the reverse proxy to serve these app. I can browse to each one of them and even open the discovery endpoint for the STS. Problem comes when I try to login into the web portal, it tries to redirect me back to the STS for logging in but I'm getting ERR_CONNECTION_REFUSED the url looks okay I think it's the STS that is not available from the redirection from the Web UI.

My docker-compose is as below:

version: '3.4'

services:
  reverseproxy:
    container_name: reverseproxy
    image: nginx:alpine
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      - ./proxy.conf:/etc/nginx/proxy.conf
      - ./cert:/etc/nginx
    ports:
      - 8080:8080
      - 8081:8081
      - 8082:8082
      - 443:443
    restart: always
    links:
      - sts
      sts:
    container_name: sts
    image: idsvrsts:latest
    links:
      - localdb
    expose:
      - "8080"

  kernel:
    container_name: kernel
    image: kernel_api:latest
    depends_on:
      - localdb
    links:
      - localdb

  portal:
    container_name: portal
    image: webportal:latest
    environment:
      - TZ=Europe/Moscow
    depends_on:
      - localdb
      - sts
      - kernel
      - reverseproxy

  localdb:
    image: mcr.microsoft.com/mssql/server
    container_name: localdb
    environment:
      - 'MSSQL_SA_PASSWORD=password'
      - 'ACCEPT_EULA=Y'
      - TZ=Europe/Moscow
    ports:
      - "1433:1433"
    volumes:
      - "sqldatabasevolume:/var/opt/mssql/data/"

volumes:
  sqldata:

And this is the nginx.config:

worker_processes 1;

events { worker_connections 1024; }

http {

    sendfile on;
    upstream docker-sts {
        server sts:8080;
    }
    upstream docker-kernel {
        server kernel:8081;
    }
    upstream docker-portal {
        server portal:8081;
    }
    ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_certificate cert.pem;
    ssl_certificate_key key.pem;
    ssl_password_file global.pass;
    proxy_http_version 1.1;
    proxy_set_header   Upgrade $http_upgrade;
    proxy_set_header   Connection keep-alive;
    proxy_cache_bypass $http_upgrade;
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Host $server_name;
    proxy_set_header X-Forwarded-Proto $scheme;

    server {
        listen 8080;
        listen [::]:8080;
        server_name sts;

        location / {
            proxy_pass         http://docker-sts;
            # proxy_redirect     off;
        }
    }

    server {
        listen 8081;
        listen [::]:8081;
        server_name kernel;

        location / {
            proxy_pass         http://docker-kernel;
        }
    }

    server {
        listen 8082;
        listen [::]:8082;
        server_name portal;

        location / {
            proxy_pass         http://docker-portal;
        }
    }
}

The web ui redirects to the below url, which works okay if I browse to it using the STS server without nginx.

http://localhost/connect/authorize?client_id=myclient.id&redirect_uri=http%3A%2F%2Flocalhost%3A22983%2Fstatic%2Fcallback.html&response_type=id_token%20token&scope=openid%20profile%20kernel.api&state=f919149753884cb1b8f2b907265dfb8f&nonce=77806d692a874244bdbb12db5be40735

Solution

Found the issue. The containers could not see each other because nginx was not appending the port on the url. I changed this: 'proxy_set_header Host $host;' To this: 'proxy_set_header Host $host:$server_port;'

Answered By - Jane Senya

Answer Checked By - Senaida (PHPFixing Volunteer)