Overriding where signin-oidc callback redirects after succeded authentication

Question

I'm hosting an ASP.NET Core 2.x web app behind a load balancer. Let's say the public url is public_url.com. Internally, the app is in private_url.com/iis_sub_dir.

I could do this setup by adding a custom BasePath middleware first thing in the pipeline.

The Problem: After logging in using OpenIdConnect middleware towards an external provider, it returns to my /signin-oidc callback path successfully with 302 response code, but the response header "location" is like: public_url.com/iis_sub_dir/etc. That iis_sub_dir ruins everything and I get 404.

I tried to add another custom middleware, but it seems that this request/response is not being passed to it!

Main config:

                .AddOpenIdConnect(options =>
                {
                    options.Authority = xxx;
                    options.ClientId = xxx;
                    options.CallbackPath = "/signin-oidc";
                    options.CorrelationCookie.Path = "/"; // cookie + load balancer fix
                    options.NonceCookie.Path = "/"; // cookie + load balancer fix
                    options.ResponseType = "code";
                
                
                    options.Events = new OpenIdConnectEvents
                    {
                        OnRedirectToIdentityProvider = async (ctx) =>
                        {
                            ctx.ProtocolMessage.RedirectUri = publicPath + CallbackPath;

                            await Task.FromResult(0);
                        },

PathBase middleware:

httpContext.Request.PathBase = new PathString(baseRedirectPath);

I simply want to remove that iis_sub_dir from the "location" response header of CallbackPath endpoint.

Thanks.

Answer 1

While using the OpenId Connect Authentication Scheme, make use of the RedirectUri property.

await HttpContext.ChallengeAsync("OpenId-SchemeName",
  new AuthenticationProperties() { RedirectUri = "http://public-url.com/iis_sub_dir/signin-oidc" });

See the documentation here - https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.authentication.authenticationproperties?view=aspnetcore-2.2