Identity Server and Azure Proxy

[lukazohar]

Hello,

We are experiencing an issue with configuring Identity Server to work correctly behind Azure Proxy.

When accessing the Identity Server proxy URL (e.g., https://application.domain.com/IdentityServerAPI), the URLs in the openid-configuration document are generated using the local domain where the API is hosted on IIS, instead of the proxy’s domain. The only field that correctly reflects the proxy’s URL is the issuer property.

Here is some additional context about our configuration:

• We followed the official documentation.
• We applied the forwarded headers fix mentioned in relation to the .NET 8.0.17 issue (Duende blog post).
• On Azure Proxy, we have enabled Translate URLs in application body.

We also revisited the Identity Server documentation regarding proxy scenarios, but unfortunately without success. Do you have any recommendations on what we should try next?

Kind regards,
Luka Žohar

[maartenba]

Hi Luka, the Entra ID Application Proxy should set the X-Forwarded-* headers ideally, which is something you may want to check on the application side whether these are present on incoming requests. If they are not, it may be better to reach out to Microsoft support here.

[lukazohar]

Hi Maarten,

Thanks again for your quick reply. After looking deeper into this, we confirmed your assumption that App Proxy does not send the X-Forwarded-Host header (it’s been a requested feature for some time, according to online forums).

To work around this, we ended up hard-coding the external origin in our API config and using the following approach to apply it to the Identity Server's settings:

Startup.cs

public void ConfigureServices(IServiceCollection services)
{
        services.AddSingleton<Duende.IdentityServer.Services.IServerUrls.IServerUrls>(
                new FixedServerUrls
                {
                        Origin = FunctionToGetProxyURLFromConfigFile()
                }
        );
}

FixedServerUrls.cs

public sealed class FixedServerUrls : Duende.IdentityServer.Services.IServerUrls
{
    public string? Origin { get; set; }
    public string? BasePath { get; set; }
    public string BaseUrl => string.Concat(Origin, BasePath);
}

We tested this, and it works for the client who has requested it. However, I’m concerned this approach may not hold up well across different proxies or deployment scenarios. Do you have any recommendations on what else we should consider, or has anyone else reading this post successfully tackled the same issue when using App Proxy and other proxy solutions with the IS Redistributable version?

Kind regards,
Luka

[maartenba]

Another solution would be to mimic what the .NET ForwardedHeadersMiddleware is doing so the entire ASP.NET host is aware of a rewritten host header.

For other proxies (e.g. nginx, Traefik, ...), the guidance from https://docs.duendesoftware.com/identityserver/deployment/#proxy-servers-and-load-balancers is recommended.