Ggtcf

Before getting to the question - which is how do we solve the infinite authentication loop - some information regarding architecture.

We are using .net core 2.1.

We have 2 services. The first one is the one that's facing the public traffic, does the TLS termination and figures out if the request should be passed on or not. (Perhaps to other servers) When this server figures out that the request is made to a certain path, it uses RunProxy method to map the request to the 'other' service using http. That code looks like below:

app.MapWhen(<MatchRequestCondition>, proxyTime => proxyTime.RunProxy(
 new ProxyOptions
 
 Scheme = "http",
 Host = "localhost",
 Port = "1122"
 
 ));

As an example, if you visit https://localhost:1234/abc - this would be mapped to http://localhost:1122 - which is the port where the second application lives.

Now, this secondary service uses OpenIdConnect - the configuration of it looks like below.

// Configure Services method
services.AddMvc(mvcOptions => 
AuthorizationPolicy policy = new AuthorizationPolicyBuilder()
 .RequireAuthenticatedUser()
 .Build();
 mvcOptions.Filters.Add(new AuthorizeFilter(policy));
);

services.AddAuthentication(options =>
 
 options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
 options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
 )
 .AddCookie()
 .AddOpenIdConnect(auth =>
 
 auth.ClientId = "<client_id>";
 auth.ClientSecret = "<client_secret>";
 auth.Authority = "<authority>";
 );


// Configure method
app.UseAuthentication();

Here's where it gets interesting:

If I visit the second node (the one that's meant to receive traffic from the first one only) directly - like http://localhost:1122 - I'm redirected to sign-in and everything works correctly.

But if I visit the first node (which is the one that the real traffic should be coming from) - it goes into a crazy authentication loop.

Any ideas to what might be the root cause? How is this different than having a load balancer in front of the regular service? Or perhaps it's because I'm using the cookie middleware in the secondary service?