Develop Reference

Integrating Identity Server; Docker and MVC Core (Web Client)

I am trying to get an MVC Core Web application to work with Identity Server and Docker. Here are the steps I have taken:
1) Download the quickstart: https://github.com/IdentityServer/IdentityServer4.Samples/tree/dev
Run the project and see it working as expected. Now try adding Docker to the equation:
2) Open the solution. Right click on: IdentityServerWithAspNetIdentity and select: Add Container Orchestration Support (Then Docker Compose, then Linux).
3) Right click on MVCClient and select: Add Container Orchestration Support (Then Docker Compose, then Linux).
4) Change Docker-compose.override.yml to this (note that I only changed the ports for each service from 80 to 5002:80 and 5000:80):
version: '3.4'
services:
mvcclient:
environment:
- ASPNETCORE_ENVIRONMENT=Development
ports:
- "5002:80"
identityserverwithaspnetidentity:
environment:
- ASPNETCORE_ENVIRONMENT=Development
ports:
- "5000:80"
5) Try running the project to see what happens. When I attempt to access: Home/Secure; instead of being forwarded to the login webpage; I see this error: 'Unable to obtain configuration from:http://localhost:5000/.well-known/openid-configuration'.
I believe this is because the Docker container cannot see localhost:5000. Therefore after reading through a few blog posts; I try this:
6) Open startup in the MVCClient and change this:
options.Authority = "http://localhost:5000";
to this:
options.Authority = "http://identityserverwithaspnetidentity:80";
However, I just see a DNS error (404 I believe). What do I need to do to get Identity Server working with an MVC web app in this case?
So far I have looked here: How can I use IdentityServer4 from inside and outside a docker machine? and here: Identity Server 4 and docker. However the answers have not helped so far.

As you already noticed on my thread I had a similar issue. What I did is configuring the following on my IdentityServerAuthenticationOptions (API Side):
1) Set the correct Autority, in your case I would say it should be http://identityserverwithaspnetidentity/
2) Configure the ApiName (this is the name of the ApiResource)
3) Maybe also configure JwtBackChannelHandler (Im not sure if this was required or not)
4) If you are not using Https, I would deactivate it (I don't remember if this is explicitly needed: set RequireHttpsMetadata to false)
And on the client I did the folling
1) Set the ValidateIssuerName to false
2) If you are not using Https, maybe also deactive it by setting RequireHttps to false (I don't remember if this is explicitly needed)

I might be a little late but I hope this can help someone with a similar issue.
Some things to keep in mind:
This is not an issue with Identity Server itself but with the mismatch between the internal Docker URL (http://identityserverwithaspnetidentity) that your container sees and the local host URL (http://localhost:5000) that your browser sees.
You should keep using the local URL for Identity Server (http://localhost:5000) and add a special case to handle the container to container communication.
The following fix is only for development when working with Docker (Docker Compose, Kubernetes), so ideally you should check for the environment (IsDevelopment extension method) so the code is not used in production.
IdentityServer configuration
if (Environment.IsDevelopment())
{
// It is not advisable to override this in production
options.IssuerUri = "http://localhost:5000";
}
MVC Client
// It is important this matches the actual URL of your identity server, not the Docker internal URL
options.Authority = "http://localhost:5000";
if (Environment.IsDevelopment())
{
// This will allow the container to reach the discovery endpoint
options.MetadataAddress = "http://identityserverwithaspnetidentity/.well-known/openid-configuration";
options.RequireHttpsMetadata = false;
options.Events.OnRedirectToIdentityProvider = context =>
{
// Intercept the redirection so the browser navigates to the right URL in your host
context.ProtocolMessage.IssuerAddress = "http://localhost:5000/connect/authorize";
return Task.CompletedTask;
};
}
You can tweak the code a little bit by passing said URLs via configuration.

I have been struggling with the same problem for the last couple of days and finally found a solution that works! All you need to do is set the Authority (in your mvc client) and IssuerUri (in your identity API) to the IP address of your docker host. On windows this is 10.0.75.1.
I was finally able to come up with this after reviewing the implementation in eShopOnContainers which I've found is a really great resource for learning how to implement a dockerized microservice architecture in .NET Core.

Need help related internal network communication using an asp.net mvc solution

In a new project as frontend developer the team I joined is using ASP.NET MVC for the backend. I am running a mac, so this means I can only compile the C# sources on Windows to run the application locally.
I have a Win10 setup inside a VM using virtual box. The sources are on the host and shared to the guest via a samba share (On Z:\ in the guest) and a host-only network adapter. Goal is to reach the app then from the host using the IP of the Guest, i.e. https://192.168.56.102:44301/ (it`s a single page application written in angular)
In the guest I compile from the command line using msbuild and then I start the REST API and the "Web App" using iisexpress.exe: (because visual studio is way to slow in the guest)
commands to build & start:
msbuild Z:\TheApp.sln
:: shell #1
iisexpress.exe" /config:Z:\.vs\config\applicationhost.config /site:"AppName.Api"
:: shell #2
iisexpress.exe" /config:Z:\.vs\config\applicationhost.config /site:"AppName.Web"
In Web.config of the Solution AppName.Web I have the following option:
<add key="ApiEndpointBase" value="https://192.168.56.102:44302/" />
The REST API is listening on port 44302, the "web app" on port 44301
So when I enter https://192.168.56.102:44301/ I get the app served.
The problem:
For each page reload the web app (HomeController.cs) does an http request against the API, so this means it is internally communicating to https://192.168.56.102:44302/
// HomeController.cs
// this fails with an exception like "An error occurred while processing your request.":
private readonly HttpClient client = new HttpClient();
...
/// <returns>The index view.</returns>
public async Task<ActionResult> Index() {
var response = await clientclient.GetAsync("api/foo?someId=" + someId);
client.BaseAddress is https://192.168.56.102:44302/
So there are two apps running in the guest using iisexpress, and one of them does an http request against the other using the Address https://192.168.56.102:44302/.... - and this request times out, or fails somehow and I don't get why.
It works if:
<add key="ApiEndpointBase" value="https://localhost:44302/" />
I visit https://localhost:44301/ in a browser inside the guest
But I want to access it from a browser on the host. Would really appreciate if some asp.net devs may help me here :)
EDIT:
External requests are already working. Else I would not get the app served on the host. I also registered the URLs using netsh and windows firewall is disabled on the guest. So I think this is not a duplicate of IIS Express enable external request

Check if an Azure VM is running

I want to query an existing azure virtual machine to check whether it is fully deployed and able to be connected to remotely. Is there any way to do this using the Azure Rest API?
I've outlined my current process and why I desire such a call below.
I am using the Windows Azure management library to create a VM using ComputeManagementClient and the CreateDeploymentAsync function. This then returns a status of Succeeded, if I then do a get on the deployment it has a status of DeploymentStatus.Running.
After this has run I am trying to create a remote powershell connection so I can format the disk. I keep getting an error on this as it is unable to create the session.
WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet. For more information, see the about_Remote_Troubleshooting Help topic.
If I go to the azure management portal the status is provisioning, I assume this is why i cannot create a session.
Process
CreateAzureVM()
CheckAzureVmCanBeConnectedTo() //I am unable to do this correctly
RunPowershellScriptOnVM() // this fails

You should be able to use Get Deployment to poll for the role's InstanceStatus (note that InstanceStatus != Status). When the InstanceStatus is ReadyRole, you should be able to log into your machine.
There's a distinction between a Deployment status and a Role InstanceStatus. Think of the role as an actual virtual machine, whereas a Deployment may describe multiple VMs.

SubscriptionCloudCredentials certificate = new CertificateCloudCredentials(subscriptionId, x509Certificate);
IComputeManagementClient ComputeManagementClient = new ComputeManagementClient(certificate);
var deployments = ComputeManagementClient.Deployments.GetBySlot(hostedServiceName, DeploymentSlot.YourDeploymentSlot);
var state = deployments.RoleInstances.First().PowerState;
I hope that this will help you.

Without seeing your code it's hard to say exactly what you need to do but I would recommend that you utilise the await keyword to wait for the completion of the call to the Azure API to create the VM. See the code samples under "Deploy a Virtual Machine" in this MSDN guide: http://msdn.microsoft.com/en-us/library/azure/dn722415.aspx#bk_createres

.NET HttpClient Connect To Web Service through VPN

I have an application that needs to communicate with a web server hosted on an external provider. It's been configured to only allow incoming connections from IP addresses that it recognizes.
If I needed to connect when I was working remotely and connected through VPN, I would add routes through a terminal window like sudo route -n add -net 22.222.222.22/32 192.168.133.1
I don't want every user that works remotely to have to do this. Can I do something in the application layer to allow a user that connected through the VPN to connect to the remote web server and use the VPN tunnel? It is a C# Winforms application.

I'm assuming all of the users of your app are behind the same firewall? If that's the case, then your network admin should be able to setup the routing for you either on the router directly or on your NAT server. It's also worth noting that, at least at my company, we've always had to add the routing statements twice - one for internal and one for outside over VPN. It would be a massive security vulnerability if an app could modify your computer's routing table so I wouldn't do that.
One more thought - it's possible that your VPN uses a common feature called split tunneling which means that all destinations behind your firewall would go over VPN (and have the associated routing rules applied), but any destinations outside (such as your external provider) are split and instead go straight out without any routing. The only way around this would be to setup a VPN tunnel between your firewall and your external provider (e.g. at my company we've done this with our cloud servers so they are accessible over VPN).
http://en.wikipedia.org/wiki/Split_tunneling

I could discern in your comments, that you are trying to add a route in a windows environment, but only found a command that works on linux?!
But I actually don't get your drift, and what the result of your application should be.
First of all I'll try to help you adding a route to your routing table with C# on a windows machine. (Server-sided)
I've created a little WinForm with a Button-Control btnAddRoute and a Textbox-Control textBox1 to give you an example:
Adding routes only works as administrator btw
private void btnAddRoute_Click(object sender, EventArgs e)
{
// route -p add xxx.xxx.xxx.xxx mask 255.255.0.0 xxx.xxx.xxx.xxx
string netIp = "22.222.222.22";
string mask = "255.255.255.255";
string exitIp = "192.168.133.1";
string arg = String.Format("-p add {0} mask {1} {2}", netIp, mask, exitIp);
Process p = new Process
{
StartInfo =
{
UseShellExecute = false,
FileName = "route",
Arguments = arg,
RedirectStandardOutput = true,
StandardOutputEncoding = Encoding.ASCII
}
};
p.Start();
textBox1.Text = p.StandardOutput.ReadToEnd();
}
This adds a route with the specified IP's to your routing table, and returns OK! or Failed! depending on if the action was successfully or not.
Is this more or less what you want? Or did I totally amiss?

windows store app 8.1 httpclient request failes in local private network

http request to receive json fails in private network or even in same system server set with xamp it is working fine with public networks over internet.
i have given internet client&server , private networks capabilities in appxmanifest
code:
public static async Task<string> GetStringfromUrl(string url)
{
var httpClientHandler = new HttpClientHandler();
httpClientHandler.Credentials = new System.Net.NetworkCredential(GlobalVariables.Web_AccountName,GlobalVariables.Web_AccountPassword);
HttpClient httpClient = new HttpClient(httpClientHandler);
try
{
string responseBodyAsText;
HttpResponseMessage response = await httpClient.GetAsync(url);
response.EnsureSuccessStatusCode();
responseBodyAsText = await response.Content.ReadAsStringAsync();
return responseBodyAsText;
}
catch(Exception ex)
{
System.Diagnostics.Debug.WriteLine(ex.Message +"/n" + ex.InnerException);
return null;
}
}
in private network it shows authorization exception ,in same system localhost it doesnt pass the line of code.while works all fine in public internet
please help

Information upon which solution to try is based
"Using network loopback in side-loaded Windows Store apps"
http://msdn.microsoft.com/en-us/library/windows/apps/dn640582.aspx
# section "Configuring the firewall"
CheckNetIsolation utility
Windows Firewall also blocks loopback connections for all Windows
Store apps by default. A device admin can enable loopback for a
Windows Store app using the CheckNetIsolation.exe tool. This tool is
available on the command line in any Windows 8.1 installation.
Solution to try
Use # command prompt
checknetisolation loopbackexempt -a -n=<package-family-name>
Where
-a
stands for add
-n
stands for AppContainer Name or Package Family Name (which we care in this case) and
<package-family-name>
can be found # packaging.appmanifest # packaging
CheckNetIsolation.exe usage
CheckNetIsolation LoopbackExempt [operation] [-n=] [-p=]
List of operations: -a -d -c -s
List of arguments: -n= -p= -?
Context within the issue was encountered in my case
During testing a Windows (Store App) Portable Library via a Windows (Store App) Unit Test which accessed a localhost self hosting WebAPI setup-ed by a parallel running console app.
Notes
I too tried the Capabilities, you reffer to, to no avail and after fixing the problem I actually reverted back to original configuration which did not use any of those 2 additional ones (Internet (Client & Server), Private Networks (Client & Server)) to see if they mattered and the solution above still worked, probably because those have to do with having your app behave as a server and handle requests.
Let me know if this resolves the issue and if yes don't forget to accept the answer!