License: Multiple issuers detected. Is this a licensing violation?

[aru-op]

Duende Identity Server: 7.1.0
.NET target framework: .net 8.0

I'm seeing the following verbose log message from Duende IdentityServer regarding license restrictions:

Your license for Duende IdentityServer only permits 1 number of issuers. You have processed requests for 3. The issuers used were: ["http://10.10.10.1/xxx", "http://localhost:4567", "http://localhost/xxx"]. This might be due to your server being accessed via different URLs or a direct IP and/or you have reverse proxy or a gateway involved. This suggests a network infrastructure configuration problem, or you are deliberately hosting multiple URLs and require an upgraded license.

In my case, clients access the IdentityServer either locally or remotely
Is this considered a license violation? If so, what would be the recommended way to resolve or configure this correctly?

[wcabus]

The recommended way to go about this depends on why you are accessing the same IdentityServer host remotely and locally.

• You could try and solve this by updating the HOSTS file on each system if you are in an air gapped environment, allowing you to access IdentityServer via https://identityserver.local e.g. for every client involved, rather than having different IP addresses.
• You could override the IssuerUri property in IdentityServer's Options to set a fixed IssuerUri. This also requires you to update any clients not accessing IdentityServer using the "correct" issuer URI: you must configure the metadata address manually to visualize the difference between the expected authority http://10.10.10.1/xxx and where the metadata can be found, at http://localhost/xxx/.well-known/openid-configuration in your example.

[aru-op]

thank you for the answer. Is this considered a license violation? It appears as a verbose message, not an error

[wcabus]

In this case, it's probably not a license violation, but IdentityServer can't know for sure when it detects more issuer URIs being used than allowed by the license.

We do log these events to inform you, and also have a license usage summary since v7.1 which shows additional information about how you're using IdentityServer compared to the license you have.

At this moment, IdentityServer only logs messages when it detects a potential license violation. We will communicate on our channels (release notes and blog) if we plan to change this behavior.