<p><strong>Architecture</strong><br>
Our web-applications are being deployed to our kubernetes cluster which are being integrated in our application gateway via the ingress extension (Azure Gateway ingress). If you navigate to the web-application, you need to sign-in and authenticate via configured app registration in our AAD B2C.</p>
<p>The web-application itself is being hosted on port 80 in our kubernetes cluster, but will be accessible via https within our application gateway. The application gateway will have the necessary certificates and so on.
The docker-compose (deployment of the pods) have enabled the environment variable &quot;FORWARDING_HEADERS&quot;.</p>
<p>The AAD B2C does have the correct redirect URIs configured.</p>
<p><em>Startup.cs</em></p>
<pre class="lang-cs prettyprint-override"><code>public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllersWithViews(options =&gt;
                {
                    var policy = new AuthorizationPolicyBuilder()
                        .RequireAuthenticatedUser()
                        .Build();
                    options.Filters.Add(new AuthorizeFilter(policy));
                }).AddMicrosoftIdentityUI()
               .AddJsonOptions(options =&gt; options.JsonSerializerOptions.PropertyNamingPolicy = null)
               .AddDapr();

            services.AddCookiePolicy(options =&gt;
            {
                options.Secure = CookieSecurePolicy.Always;
                options.MinimumSameSitePolicy = SameSiteMode.None;
                options.HandleSameSiteCookieCompatibility();
            });
            
            services.UseCoCoCore()
                .UseCoCoCoreBootstrapper&lt;CoreComponent&gt;()
                .UseCoCoCoreBootstrapper&lt;UiComponent&gt;()
                //the following line is registering the AuthComponent, see below for more details
                .UseCoCoCoreBootstrapper&lt;UiAuthComponent&gt;();
        }

public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ILoggerFactory loggerFactory, ILog logger)
        {
            loggerFactory.AddSerilog(logger.GetLogger(), dispose: true);
            if (!env.IsDevelopment())
            {
                app.UseExceptionHandler(&quot;/Home/Error&quot;);
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseCookiePolicy();
            //app.UseHttpsRedirection();
            app.UseStaticFiles();

            app.UseRouting();

            app.UseAuthentication();
            app.UseAuthorization();


            app.UseEndpoints(endpoints =&gt;
            {
                endpoints.MapControllerRoute(
                    name: &quot;default&quot;,
                    pattern: &quot;{controller=Home}/{action=Index}/{id?}&quot;);
            });
        }

</code></pre>
<p><em>AuthComponent.cs</em>
It is basically this</p>
<pre class="lang-cs prettyprint-override"><code>
public void RegisterAuthorization(IConfiguration configuration, string configSectionName, string[] intialScopes)
        {
            _serviceCollection.AddMicrosoftIdentityWebAppAuthentication(configuration, configSectionName)
                .EnableTokenAcquisitionToCallDownstreamApi(intialScopes)
                .AddInMemoryTokenCaches();

            _serviceCollection.AddAuthorization(options =&gt;
                {
                    options.AddPolicy(&quot;IsGroupMember&quot;,
                        policy =&gt; { policy.Requirements.Add(new IsGroupMemberRequirement()); });
                }););
        }
</code></pre>
<p>I am using a configuration with this properties</p>
<pre class="lang-json prettyprint-override"><code>{
  &quot;AzureAdB2CConfig&quot;: {
    &quot;Instance&quot;: &quot;https://login.microsoftonline.com/&quot;,
    &quot;Domain&quot;: &quot;myAaadB2c.onmicrosoft.com&quot;,
    &quot;ClientId&quot;: &quot;&lt;client-id&gt;&quot;,
    &quot;TenantId&quot;: &quot;&lt;tenant-id&gt;&quot;,
    &quot;ClientSecret&quot;: &quot;&lt;client-secret&gt;&quot;,
    &quot;CallbackPath&quot;: &quot;/myapp/signin-oidc&quot;
  }
}
</code></pre>
<p><strong>What I expect</strong><br>
Navigating to our <a href="https://custom.domain.com/myapp/" rel="nofollow noreferrer">https://custom.domain.com/myapp/</a> should allow me to authenticate myself and forward to the desired entry point of my web-application, e.g. <a href="https://custom.domain.com/myapp/Overview" rel="nofollow noreferrer">https://custom.domain.com/myapp/Overview</a></p>
<p><strong>What is actually happening?</strong><br>
The following scenarios are working without any problems:</p>
<ul>
<li>Running the application on my machine via localhost.</li>
<li>Running the application in my kubernetes cluster, exposed via LoadBalancer, and accessing it via the public IP.</li>
</ul>
<p>If I am navigating to the following url <a href="https://custom.domain.com/myapp/" rel="nofollow noreferrer">https://custom.domain.com/myapp/</a> , I am getting the HttpStatusCode 404. The 404 is about &quot;/signin-oidc&quot; which he cannot find. I have checked via my browser the header entries and it looks OK for me. The hostname of my header is also correct (custom.domain.com).</p>
<p><strong>Additional info</strong><br>
<em>Ingress configuration</em></p>
<pre class="lang-yaml prettyprint-override"><code>kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
  name: myapp
  namespace: myapp-namespace
  annotations:
    appgw.ingress.kubernetes.io/appgw-ssl-certificate: myCert
    appgw.ingress.kubernetes.io/backend-hostname: custom.domain.com
    appgw.ingress.kubernetes.io/backend-path-prefix: /
    appgw.ingress.kubernetes.io/cookie-based-affinity: 'true'
    kubernetes.io/ingress.class: azure/application-gateway
spec:
  rules:
    - http:
        paths:
          - path: /myapp/*
            pathType: Exact
            backend:
              service:
                name: myapp-service
                port:
                  number: 80
</code></pre>

Insight
<p>I have found the solution via <a href="https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-6.0" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-6.0</a></p>
<p>I added to my application the following code</p>
<pre class="lang-cs prettyprint-override"><code>app.Use((context, next) =&gt;
{
    context.Request.PathBase = new PathString(&quot;/myapp&quot;);
    return next(context);
});
</code></pre>
<p>I also changed the callbackpath back to /signin-oidc</p>
