<p>I have IS4 deployed to a K8s cluster.  On the same cluster I have a WebApp which the User is calling in to.</p>

<p>User (Goes to) -> WebApp (Redirects when not authed)-> IS4.</p>

<p>The issue I'm having is that when I set <code>options.Authority</code> on the WebApp to the external FQDN, then the WebApp fails to find the discovery document.  When I set <code>options.Authority</code> to the internal service name, then the User is redirected to an authorize endpoint they cannot access.</p>

<p>I have tried configuring all of these in IS4: <code>Authority</code>, <code>PublicOrigin</code> &amp; <code>IssuerUri</code>.</p>

<p>While AKS gives me the ability to resolve the external DNS and through some sort of magic it routes correctly, I'm unable to develop locally due to this resolution issue.</p>

<p>The options I can think of are:</p>

<ol>
<li>Update K8s to force pods to do a "full" DNS lookup. </li>
<li>Update IS4
to have the servers communicate using one set of URLs and the users
communicate using another.</li>
</ol>

<p>I cannot find much on either of these subjects, so advice would be welcome.  </p>

<p>Ideally, I'd like the K8s services to communicate using the internal service names, and when a user needs to authenticate, they are directed to the publicly available address.</p>

Stevey
<p>It turns out that having an internal service name isn't allowed ("all parties must use the same DNS name"): <a href="https://github.com/IdentityServer/IdentityServer4/issues/3568#event-2588006001" rel="nofollow noreferrer">https://github.com/IdentityServer/IdentityServer4/issues/3568#event-2588006001</a></p>
