{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2928","repository_url":"https://api.github.com/repos/IdentityServer/IdentityServer3","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2928/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2928/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2928/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2928","id":156989158,"number":2928,"title":"How to setup idsrv to run via web application proxy in a preauthentication scenario","user":{"login":"dandohotaru","id":1856429,"avatar_url":"https://avatars.githubusercontent.com/u/1856429?v=3","gravatar_id":"","url":"https://api.github.com/users/dandohotaru","html_url":"https://github.com/dandohotaru","followers_url":"https://api.github.com/users/dandohotaru/followers","following_url":"https://api.github.com/users/dandohotaru/following{/other_user}","gists_url":"https://api.github.com/users/dandohotaru/gists{/gist_id}","starred_url":"https://api.github.com/users/dandohotaru/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dandohotaru/subscriptions","organizations_url":"https://api.github.com/users/dandohotaru/orgs","repos_url":"https://api.github.com/users/dandohotaru/repos","events_url":"https://api.github.com/users/dandohotaru/events{/privacy}","received_events_url":"https://api.github.com/users/dandohotaru/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-05-26T13:54:13Z","updated_at":"2016-06-14T18:31:12Z","closed_at":null,"body":"- [x] I read and understood how to enable [logging](https://identityserver.github.io/Documentation/docsv2/configuration/logging.html)\r\n\r\nHi,\r\n\r\nI am having a particular cors related issue for an enterprise environment.\r\nLet me first try to explain the environment i deal with.\r\n\r\nwap: \r\n\r\n- web application proxy in dmz\r\n\r\nadfs: \r\n\r\n- https://auth.domain.com\r\n- runing on windows 2012 R2\r\n\r\napp: \r\n\r\n- https://app.domain.com\r\n- angular application\r\n- implicit client flow\r\n\r\napi: \r\n\r\n- https://api.domain.com\r\n- rest service\r\n\r\nauth: \r\n\r\n- https://sts.domain.com\r\n- identity server\r\n- custom cors policy service matching client allowed origins\r\n\r\nEverything works as expected when we are in a pass through scenario for the wap.\r\n_GET https://sts.domain.com/core/.well-known/openid-configuration\r\n200 OK_\r\n\r\nThe moment we switch to pre authentication we get into trouble \r\n_GET https://sts.domain.com/core/.well-known/openid-configuration\r\n307 Temporary Redirect_\r\n\r\n_XMLHttpRequest cannot load https://sts.domain.com/core/.well-known/openid-configuration. \r\nNo 'Access-Control-Allow-Origin' header is present on the requested resource. \r\nOrigin 'https://app.domain.com' is therefore not allowed access._\r\n\r\n\r\n**General**\r\nRequest URL:https://sts.domain.com/core/.well-known/openid-configuration\r\nRequest Method:GET\r\nStatus Code:307 Temporary Redirect\r\nRemote Address:...\r\n\r\n**Response Headers**\r\nview source\r\nContent-Length:0\r\nDate:Thu, 26 May 2016 09:29:24 GMT\r\nLocation:https://auth.domain.com/adfs/ls?version=1.0&action=signin&realm=...\r\nServer:Microsoft-HTTPAPI/2.0\r\n\r\n\r\n**Request Headers**\r\nview source\r\nAccept:*/*\r\nAccept-Encoding:gzip, deflate, sdch, br\r\nAccept-Language:en-US,en;q=0.8,fr;q=0.6,ro;q=0.4\r\nCache-Control:no-cache\r\nConnection:keep-alive\r\nHost:sts.domain.com\r\nOrigin:https://app.domain.com\r\nPragma:no-cache\r\nReferer:https://app.domain.com/login\r\nUser-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.63 Safari/537.36\r\n\r\nDo you happen to know how i could overcome this knowing that the preauthentication is a constraint that i can't play much with?\r\n\r\nThanks,\r\nDan\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/225973773","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/2928#issuecomment-225973773","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/2928","id":225973773,"user":{"login":"dandohotaru","id":1856429,"avatar_url":"https://avatars.githubusercontent.com/u/1856429?v=3","gravatar_id":"","url":"https://api.github.com/users/dandohotaru","html_url":"https://github.com/dandohotaru","followers_url":"https://api.github.com/users/dandohotaru/followers","following_url":"https://api.github.com/users/dandohotaru/following{/other_user}","gists_url":"https://api.github.com/users/dandohotaru/gists{/gist_id}","starred_url":"https://api.github.com/users/dandohotaru/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dandohotaru/subscriptions","organizations_url":"https://api.github.com/users/dandohotaru/orgs","repos_url":"https://api.github.com/users/dandohotaru/repos","events_url":"https://api.github.com/users/dandohotaru/events{/privacy}","received_events_url":"https://api.github.com/users/dandohotaru/received_events","type":"User","site_admin":false},"created_at":"2016-06-14T18:31:12Z","updated_at":"2016-06-14T18:31:12Z","body":"Unfortunately we could not make the cors work as expected, given the constraints...\r\nI have very little to no control over the infrastructure configuration but i highly doubt that we are the first one to have to integrate idsrvr with a corporate proxy such as microsoft wap.\r\nYou might say this a microsoft issue nevertheless, and you might be right, but i raised the issue here hoping that someone might have reached the same walls i had\r\n\r\nJust for visualization purposes, this is what i have now in place working as expected\r\n\r\n![image](https://cloud.githubusercontent.com/assets/1856429/16054599/227bd856-326e-11e6-8890-337513e48f14.png)\r\n\r\nand this is the goal trying to reach with wap pre-auth on all levels but adfs\r\n\r\n![image](https://cloud.githubusercontent.com/assets/1856429/16054616/3864cd1c-326e-11e6-979b-2879f84c6d42.png)\r\n\r\nbut the flow fails the moment pre-auth is set for idsrvr as well\r\n\r\n![image](https://cloud.githubusercontent.com/assets/1856429/16054707/97fc3328-326e-11e6-8603-b6f5f3a4a857.png)\r\n\r\nCheers,\r\nDan"}}
{"actor":{"display_login":"dandohotaru"}}