0

I'm connecting authorization for the project via Identity Server 4. I have 2 projects, one has an IdentityServer, the second just an api. The fact is that when I launch the api locally, transfer the token from the Identity Server to the api, everything is fine, but when I launch the api through docker-compose and send the token from the IdentityServer, it returns 401. The error says: Bearer error - invalid_token - The signature key was not found.

I will attach the Docker-compose file

services:
  # Identity
  identity:
    container_name: identity
    image: identity
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
    build:
      context: .
      dockerfile: ./GChain.Identity/GChain.Identity.Api/Dockerfile
    ports:
      - "10001:8080"
    networks:
      - postgres_identity_network
    volumes:
      - app_identity_data:/data/identity
    depends_on:
      - postgres_identity_db

  postgres_identity_db:
    container_name: postgres_identity
    image: postgres:latest
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-passwd}
      POSTGRES_DB: identity
    volumes:
      - postgres_identity_data:/data/postgres_identity
    ports:
      - "5432:5432"
    networks:
      - postgres_identity_network
    restart: unless-stopped

  # Posts 
  posts:
    container_name: posts
    image: posts
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
    build:
      context: .
      dockerfile: ./GChain.Posts/GChain.Posts.Api/Dockerfile
    ports:
      - "8082:8080"
    networks:
      - postgres_posts_network
    volumes:
      - app_posts_data:/data/posts
    depends_on:
      - postgres_posts_db

  postgres_posts_db:
    container_name: postgres_posts
    image: postgres:latest
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-passwd}
      POSTGRES_DB: posts
    volumes:
      - postgres_posts_data:/data/postgres_posts
    ports:
      - "6002:5432"
    networks:
      - postgres_posts_network
    restart: unless-stopped

networks:
  postgres_identity_network:
    driver: bridge
  postgres_posts_network:
    driver: bridge

volumes:
  app_identity_data:
  app_posts_data:
  postgres_identity_data:
  postgres_posts_data:

When I run Identity Server 4 in docker, and the api is local and I make a request to the api with a token, everything works correctly, but when I make a request to the api that is in docker, it is written that the token is not correct.

PS: I'm making a request from a test client

    [HttpPost]
    public async Task<IActionResult> TestAsync()
    {
        // discover endpoints from metadata
        var client = new HttpClient();
        var disco = await client.GetDiscoveryDocumentAsync("http://localhost:10001");
        if (disco.IsError)
            return BadRequest(disco.Error);
        
        // request token
        var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
        {
            Address = disco.TokenEndpoint,

            ClientId = "client",
            ClientSecret = "secret",
            Scope = "api1"
        });

        if (tokenResponse.IsError)
            return BadRequest(disco.Error);

        Log.Information(tokenResponse.Json.ToString());
        
        // call api
        client.SetBearerToken(tokenResponse.AccessToken);

        var response = await client.GetAsync("http://localhost:8082/api/v1/identity");
        if (!response.IsSuccessStatusCode)
        {
            Log.Information(response.StatusCode.ToString());
        }
        else
        {
            var content = await response.Content.ReadAsStringAsync();
            Log.Information(JArray.Parse(content).ToString());
        }

        return StatusCode((int) response.StatusCode);
    }
1
  • After taking a quick look at what you posted, one thing you can double check is the issuer on your token. Some tokens have urls placed there with exact ports specified. As a sanity check, I'd make sure the jwks url for the issuer in the token can be reached from within the container
    – Randy
    Commented Jul 2 at 21:26

0