I have a Service Fabric cluster that is running a service (Stateless ASP.Net Core) that can't be exposed to the Internet. Requests to the service are routed through API Management.
Incoming request ==> https://blah.trafficmanager.net/routeName
forwarded ==> https://10.0.4.6:[port]/routeName
This works fine with no authentication. I am hooking up AAD auth as we need to lock this down to a client registration (due to timeboxed elevation request requirements). I have set up the service to use AAD auth, and when running in my local development Service Fabric cluster, this works fine (i.e. prompted to log in, routes are gated based on roles) using these parameters:
"AzureAd:ClientId": "[client id]",
"AzureAd:Domain": "[tenant].onmicrosoft.com",
"AzureAd:Instance": "https://login.microsoftonline.com/",
"AzureAd:SignedOutCallbackPath": "/signout-callback-oidc",
"AzureAd:CallbackPath": "/signin-oidc",
"AzureAd:TenantId": "[tenant id]",
When I deploy this and try to hit it via https://blah.trafficmanager.net/routeName, the redirect https://10.0.4.6:44321/signin-oidc, and I end up with:
Here is my startup.cs code:
/// <summary>
/// Configure services
/// </summary>
/// <param name="services">Service collection</param>
public void ConfigureServices(IServiceCollection services)
{
services.AddHttpContextAccessor();
services.Configure<CookiePolicyOptions>(options =>
{
// This lambda determines whether user consent for non-essential cookies is needed for a given request.
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
// Handling SameSite cookie according to https://docs.microsoft.com/en-us/aspnet/core/security/samesite?view=aspnetcore-3.1
options.HandleSameSiteCookieCompatibility();
});
// Sign-in users with the Microsoft identity platform
services.AddMicrosoftWebAppAuthentication(this.Configuration);
services.Configure<ForwardedHeadersOptions>(options =>
{
options.ForwardedHeaders = ForwardedHeaders.All;
options.KnownProxies.Add(IPAddress.Parse("10.0.4.6"));
});
// services.AddControllers();
services.AddControllers(options =>
{
var policy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.Build();
options.Filters.Add(new AuthorizeFilter(policy));
});
}
/// <summary>
/// Configure app
/// </summary>
/// <param name="app">App builder</param>
/// <param name="env">Environment</param>
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
app.UseDeveloperExceptionPage();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseCookiePolicy();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseForwardedHeaders();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllers();
});
}
I am wondering if there is something I can do in order to be able to have this service on the cluster node be able to authenticate requests that are coming in through APIM.
Thanks!