问Asp.net Blazor服务器应用无法在具有OIDC的kubernetes中重定向

EN

warn: Microsoft.AspNetCore.Http.ResponseCookies[1]
      The cookie '.AspNetCore.OpenIdConnect.Nonce.CfDJ8EYehvsxFBVNtGDsitGDhE8K9FHQZVQwqqr1YO-zVntEtRgpfb_0cHpxfZp77AdGnS35iGRKYV54DTgx2O6ZO_3gq98pbP_XcbHnJmBDtZg2g5hhPakTrRirxDb-Qab0diaLMFKdmDrNTqGkVmqiGWpQkSxcnmxzVGGE0Cg_l930hk6TYgU0qmkzSO9WS16UBOYiub32GF4I9_qPwIiYlCq5dMTtUJaMxGlo8AdAqknxTzYz4UsrrPBi_RiWUKaF6heQitbOD4V-auHmdXQm4LE' has set 'SameSite=None' and must also set 'Secure'.
warn: Microsoft.AspNetCore.Http.ResponseCookies[1]
      The cookie '.AspNetCore.Correlation.MMrYZ2WKyYiV4hMC6bhQbGZozpubcF2tYsKq748YH44' has set 'SameSite=None' and must also set 'Secure'.
warn: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[15]
      '.AspNetCore.Correlation.MMrYZ2WKyYiV4hMC6bhQbGZozpubcF2tYsKq748YH44' cookie not found.
fail: Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware[1]
      An unhandled exception has occurred while executing the request.
      System.Exception: An error was encountered while handling the remote login.
       ---> System.Exception: Correlation failed.
         --- End of inner exception stack trace ---
         at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
         at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
         at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)

public class Startup
{
    private static readonly object refreshLock = new object();
    private IConfiguration Configuration;
    private readonly IWebHostEnvironment Env;

    public Startup(IConfiguration configuration, IWebHostEnvironment env)
    {
        Console.WriteLine($"LogQAApp Version: {Assembly.GetExecutingAssembly().GetName().Version}");
        // We apparently need to set a CultureInfo or some of the Razor pages dealing with DateTimes, like LogErrorCountByTime fails with JavaScript errors.
        // I wanted to set it to CultureInvariant, but that wouldn't take.  Didn't complain, but wouldn't actually set it.
        CultureInfo.DefaultThreadCurrentCulture = new CultureInfo("en-US");
        CultureInfo.DefaultThreadCurrentUICulture = new CultureInfo("en-US");
        Configuration = configuration;
        Env = env;
    }

    // This method gets called by the runtime. Use this method to add services to the container.
    // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
    public void ConfigureServices(IServiceCollection services)
    {
        services.Configure<ForwardedHeadersOptions>(options =>
        {
            options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
        });
        Encoding.RegisterProvider(CodePagesEncodingProvider.Instance);  // Needed for 1252 code page encoding.
        Syncfusion.Licensing.SyncfusionLicenseProvider.RegisterLicense("");
        services.AddSignalR(e =>
        {
            e.MaximumReceiveMessageSize = 102400000;
        });
        services.AddBlazoredSessionStorage();
        services.AddCors();
        services.AddSyncfusionBlazor();
        services.AddRazorPages();
        services.AddServerSideBlazor();
        services.AddHttpContextAccessor();

        ServiceConfigurations.LoadFromConfiguration(Configuration);

        #region Authentication


        services.AddAuthentication(options =>
        {
            options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
        })
        .AddCookie(
            options =>
            {
                options.Events = GetCookieAuthenticationEvents();
            }
        )
        .AddOpenIdConnect("SlbOIDC", options =>
        {
            options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.Authority = Configuration["SlbOIDC:Authority"];
            if (Env.IsDevelopment())
            {
                options.ClientId = Configuration["SlbOIDC:ClientID"];
                options.ClientSecret = Configuration["SlbOIDC:ClientSecret"];
            }
            else
            {
                options.ClientId = Configuration.GetValue<string>("slbclientid");
                options.ClientSecret = Configuration.GetValue<string>("slbclientsecret");
            }
            options.ResponseType = OpenIdConnectResponseType.Code;
            options.UsePkce = true;
            options.SaveTokens = true;
            options.ClaimsIssuer = "SlbOIDC";
            // Azure is communicating to us over http, but we need to tell SLB to respond back to us on https.
            options.Events = new OpenIdConnectEvents()
            {
                OnRedirectToIdentityProvider = context =>
                {
                    Console.WriteLine($"Before: {context.ProtocolMessage.RedirectUri}");
                    context.ProtocolMessage.RedirectUri = context.ProtocolMessage.RedirectUri.Replace("http://", "https://");
                    Console.WriteLine($"After: {context.ProtocolMessage.RedirectUri}");
                    return Task.FromResult(0);
                }
            };
        });

        services.AddSession(options =>
        {
            options.Cookie.SameSite = SameSiteMode.None;
            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
            options.Cookie.IsEssential = true;
        });
        #endregion

        services.AddScoped<BrowserService>();
        services.AddSingleton<ConcurrentSessionStatesSingleton>();
        services.AddSingleton<URLConfiguration>();
        services.AddScoped<CircuitHandler>((sp) => new CircuitHandlerScoped(sp.GetRequiredService<ConcurrentSessionStatesSingleton>(), sp.GetRequiredService<BrowserService>(), sp.GetRequiredService<IJSRuntime>()));
        services.AddScoped<SessionServiceScoped>();
        services.AddScoped<LogEditorScoped>();
        services.AddSingleton<ModalService>();
        services.AddFlexor();
        services.AddScoped<ResizeListener>();
        services.AddScoped<ApplicationLogSingleton>();
        services.AddScoped<LogChartsSingleton>();
        services.AddScoped<CurveNameClassificationSingleton>();
        services.AddScoped<HubClientSingleton>();
        services.AddScoped((sp) => new LogAquisitionScopedService(
            sp.GetRequiredService<URLConfiguration>(),
            sp.GetRequiredService<HubClientSingleton>(),
            sp.GetRequiredService<ApplicationLogSingleton>(),
            sp.GetRequiredService<IConfiguration>(),
            sp.GetRequiredService<SessionServiceScoped>(),
            sp.GetRequiredService<AuthenticationStateProvider>(),
            sp.GetRequiredService<IHttpContextAccessor>(),
            sp.GetRequiredService<IJSRuntime>()
            )
        );
        services.AddScoped<UnitSingleton>();
        services.AddServerSideBlazor().AddCircuitOptions(options => { options.DetailedErrors = true; });
        services.AddScoped<TimeZoneService>();
        services.AddHostedService<ExcelBackgroundService>();
        services.AddHostedService<LogEditorBackgroundService>();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Error");
            //app.UseHsts();
        }

        //app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseRouting();
        app.UseCors();
        app.UseAuthorization();
        app.UseCookiePolicy();
        app.UseForwardedHeaders(new ForwardedHeadersOptions
        {
            ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
        });
        app.UseAuthentication();

        if (!Env.IsDevelopment())
        {
            app.UseTrafficManager();
        }

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapDefaultControllerRoute();
            endpoints.MapBlazorHub();
            endpoints.MapFallbackToPage("/_Host");
        });
    }

    private CookieAuthenticationEvents GetCookieAuthenticationEvents()
    {
        return new CookieAuthenticationEvents()
        {
            OnValidatePrincipal = context =>
            {
                lock (refreshLock)
                {
                    if (context.Properties.Items.ContainsKey(".Token.expires_at"))
                    {
                        DateTime expire = DateTime.Parse(context.Properties.Items[".Token.expires_at"]);
                        if (expire.AddMinutes(-20) < DateTime.Now)
                        {
                        try
                            {
                                CloudAuthentication cloudAuthentication = new CloudAuthentication();
                                TokenResponse tokenResponse = cloudAuthentication.GetRefreshToken(context.Properties.Items[".Token.refresh_token"]);

                                context.Properties.Items[".Token.access_token"] = tokenResponse.access_token;
                                context.Properties.Items[".Token.refresh_token"] = tokenResponse.refresh_token;
                                context.Properties.Items[".Token.expires_at"] = DateTime.Now.AddSeconds(tokenResponse.expires_in).ToString();

                                context.ShouldRenew = true;
                            }
                            catch (Exception ex)
                            {
                                context.RejectPrincipal();
                            }
                        }
                    }
                    return Task.FromResult(0);
                }
            }
        };
    }
}