title: AspNet.Security.OpenIdConnect.Server (ASP.NET vNext) Authority Configuration in Mixed http/https Environments
body: <p>I am using Visual Studio 2015 Enterprise and ASP.NET vNext Beta8 to build an endpoint that both issues and consumes JWT tokens as described in detail <a href="https://stackoverflow.com/questions/33401936/validating-tokens-issued-by-aspnet-security-openidconnect-server-asp-net-vnext">here</a>. As explained in that article the endpoint uses AspNet.Security.OpenIdConnect.Server (AKA OIDC) to do the heavy lifting.</p>
  
  <p>While standing this prototype up in our internal development environment we have encountered a problem using it with a load balancer. In particular, we think it has to do with the "Authority" setting on app.UseJwtBearerAuthentication and our peculiar mix of http/https. With our load balanced environment, any attempt to call a REST method using the token yields this exception:</p>
  
  <blockquote>
    <p>WebException: The remote name could not be resolved: 'devapi.contoso.com.well-known'
    HttpRequestException: An error occurred while sending the request.<br/>
    IOException: IDX10804: Unable to retrieve document from: '<a href="https://devapi.contoso.com.well-known/openid-configuration" rel="nofollow noreferrer">https://devapi.contoso.com.well-known/openid-configuration</a>'.<br/></p>
  </blockquote>
  
  <p><br/></p>
  
  <p>Consider the following steps to reproduce (this is for prototyping and should not be considered production worthy):</p>
  
  <ul>
  <li><p>We created a beta8 prototype using OIDC as described <a href="https://stackoverflow.com/questions/33401936/validating-tokens-issued-by-aspnet-security-openidconnect-server-asp-net-vnext">here</a>.</p></li>
  <li><p>We deployed the project to 2 identically configured IIS 8.5 servers running on Server 2012 R2. The IIS servers host a beta8 site called "API" with bindings to port 80 and 443 for the host name "devapi.contoso.com" (sanitized for purposes of this post) on all available IP addresses. </p></li>
  <li><p>Both IIS servers have a host entry that point to themselves:</p>
  
  <p>127.0.0.1   devapi.contoso.com</p></li>
  <li><p>Our network admin has bound a * certificate (*.contoso.com) with our Kemp load balancer and configured the DNS entry for <a href="https://devapi.contoso.com" rel="nofollow noreferrer">https://devapi.contoso.com</a> to resolve to the load balancer. </p></li>
  <li><p>Now this is important, the load balancer has also been configured to proxy https traffic to the IIS servers using <strong>http</strong> (<em>not</em>, repeat, <em>not</em> on https). It has been explained to me that this is standard operating procedure for our company because they only have to install the certificate in one place. <em>We're not sure why our network admin bound 443 in IIS since it, in theory, never receives any traffic on this port.</em></p></li>
  <li><p>We make a secure post via https to <a href="https://devapi.contoso.com/authorize/v1" rel="nofollow noreferrer">https://devapi.contoso.com/authorize/v1</a> to fetch a token, which works fine (the details of how to make this post are <a href="https://stackoverflow.com/questions/33401936/validating-tokens-issued-by-aspnet-security-openidconnect-server-asp-net-vnext">here</a> ):</p>
  
  <p>{<br/>
      "sub": "todo",<br/>
      "iss": "<a href="https://devapi.contoso.com/" rel="nofollow noreferrer">https://devapi.contoso.com/</a>",<br/>
      "aud": "<a href="https://devapi.contoso.com/" rel="nofollow noreferrer">https://devapi.contoso.com/</a>",<br/>
      "exp": 1446158373,<br/>
      "nbf": 1446154773<br/>
  }<br/></p></li>
  <li><p>We then use this token in another secure get via https to <a href="https://devapi.contoso.com/values/v1/5" rel="nofollow noreferrer">https://devapi.contoso.com/values/v1/5</a>.</p></li>
  <li><p>OpenIdConnect.OpenIdConnectConfigurationRetriever throws the exception:</p></li>
  </ul>
  
  <blockquote>
    <p>WebException: The remote name could not be resolved: 'devapi.contoso.com.well-known'
    HttpRequestException: An error occurred while sending the request.<br/>
    IOException: IDX10804: Unable to retrieve document from: '<a href="https://devapi.contoso.com.well-known/openid-configuration" rel="nofollow noreferrer">https://devapi.contoso.com.well-known/openid-configuration</a>'.<br/></p>
  </blockquote>
  
  <p><br/></p>
  
  <p>We think this is happening because OIDC is attempting to consult the host specified in "options.Authority", which we set at startup time to  <a href="https://devapi.contoso.com/" rel="nofollow noreferrer">https://devapi.contoso.com/</a>. Further we speculate that because our environment has been configured to translate https traffic to non https traffic between the load balancer and IIS something is going wrong when the framework tries to resolve <a href="https://devapi.contoso.com/" rel="nofollow noreferrer">https://devapi.contoso.com/</a>. We have tried many configuration changes including even pointing the authority to non-secure <a href="http://devapi.contoso.com" rel="nofollow noreferrer">http://devapi.contoso.com</a> to no avail.</p>
  
  <p>Any assistance in helping us understand this problem would be greatly appreciated.</p>