<p>I have deployed the ABP framework in a Kubernetes cluster.</p>
<p>Following deployments are present:</p>
<ul>
<li>Redis</li>
<li>MSSql</li>
<li>AuthServer</li>
<li>HttpApi.Host</li>
<li>Nginx ingress / reverse proxy with https termination, no encryption within the cluster.</li>
</ul>
<p>Hence, the AuthServer, HttpApi.Host are listening on port 80 / http, and the nginx is listening on https. The configuration / Helm values are following:</p>
<pre><code>use-forwarded-headers: &quot;true&quot;
use-proxy-protocol: &quot;true&quot;
use-gzip: &quot;true&quot;
</code></pre>
<p>Everything well so far, and after deployment I can enter the Swagger and Authorize:
<a href="https://i.stack.imgur.com/qWnPa.png" rel="noreferrer"><img src="https://i.stack.imgur.com/qWnPa.png" alt="enter image description here" /></a></p>
<p>This can be confirmed when check the AuthServer logs:</p>
<pre><code>[19:12:39 INF] CORS policy execution successful.
[19:12:39 INF] The request URI matched a server endpoint: Token.
[19:12:39 INF] The token request was successfully extracted: {
  &quot;grant_type&quot;: &quot;authorization_code&quot;,
  &quot;code&quot;: &quot;[redacted]&quot;,
  &quot;client_id&quot;: &quot;foobar_Swagger&quot;,
  &quot;redirect_uri&quot;: &quot;https://api.staging.foobar.io/swagger/oauth2-redirect.html&quot;
}.
[19:12:39 INF] The token request was successfully validated.
</code></pre>
<p>However, now I would like to use the Swagger to ensure that the connection towards the endpoints are working correctly, so I try the first GET endpoint:
<a href="https://i.stack.imgur.com/E9ysV.png" rel="noreferrer"><img src="https://i.stack.imgur.com/E9ysV.png" alt="enter image description here" /></a></p>
<p>As you can see, there is a 500 response. Looking the logs at the HttpApi.Host pod:</p>
<pre><code>--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
[19:12:52 ERR] Connection id &quot;0HMSQJRK38VSM&quot;, Request id &quot;0HMSQJRK38VSM:00000005&quot;: An unhandled exception was thrown by the application.
System.InvalidOperationException: IDX20803: Unable to obtain configuration from: '[PII of type 'System.String' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
 ---&gt; System.IO.IOException: IDX20804: Unable to retrieve document from: '[PII of type 'System.String' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
 ---&gt; System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---&gt; System.IO.IOException: Unable to read data from the transport connection: Connection reset by peer.
 ---&gt; System.Net.Sockets.SocketException (104): Connection reset by peer
   --- End of inner exception stack trace ---
</code></pre>
<p>So it seems that the HttpApi can not connect to the AuthServer, since it is http according to the stacktrace above <em>&quot;The SSL connection could not be established, see inner exception&quot;</em></p>
<p>It seems like the HttpApi.Host are connecting via http inside the cluster but the AuthServer does not like it?</p>
<p>Please give me some advices here, thanks in advance.</p>

kungcc
<p>First of all, you can disable PII to see detailed information which is helpful to see the exact error. Simply add:</p>
<pre class="lang-cs prettyprint-override"><code>Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;
</code></pre>
<p>to the <code>ConfigureServices</code> method of your service.</p>
<p>The problem you are having is <em>probably</em> related to finding the correct discovery endpoint (to validate the token) in the internal network.
Your application is authenticated against the <code>Authorization URL</code> but it is trying to reach the same URL inside the k8s network to reach the discovery endpoint. However it needs to make a request to <strong>internal service name</strong> instead of the <strong>DNS</strong>.</p>
<p>We have added OIDC support to the <a href="https://github.com/abpframework/abp/pull/16574" rel="nofollow noreferrer">Volo.Abp.Swashbuckle</a> package
after <strong>v7.4-rc.1</strong> that you can define different metadata (discovery endpoint) address than the Issuer (Authorization URL).</p>
<p>You can use the <a href="https://github.com/abpframework/abp/blob/0a6cef23018053d6cc0b534d292ed409a2f53530/framework/src/Volo.Abp.Swashbuckle/Microsoft/Extensions/DependencyInjection/AbpSwaggerGenServiceCollectionExtensions.cs#L83C5-L131C6" rel="nofollow noreferrer"><code>.AddAbpSwaggerGenWithOidc()</code></a> method. Keep on mind that <strong>discovery url</strong> should be the real DNS and the <strong>authority</strong> should be the k8s service name.</p>
<p><strong>Edit:</strong>
You can check the docs at: <a href="https://docs.abp.io/en/abp/7.4/API/Swagger-Integration#using-swagger-with-oidc" rel="nofollow noreferrer">ABP Swagger Integration</a> and you can find a sample at: <a href="https://github.com/abpframework/abp-samples/tree/master/SwaggerDemo" rel="nofollow noreferrer">ABP Swagger Demo</a></p>
<p>You can set metadata as: <code>https://myauthserver.staging.mycompany.com/.well-known/openid-configuration</code>. After <strong>v7.4-rc.2</strong>, setting metadata as <code>https://myauthserver.staging.mycompany.com</code> without full path should be enough.</p>
<p>You can also set the <code>RequireHttpsMetadata</code> to false since the discovery enpoint for token validation will be done to an endpoint something like <code>http://myprojectname-st-authserver</code> instead of a real DNS like: <code>https://myauthserver.staging.mycompany.com</code></p>
