Identity Server 4 Redirect flow Correlation failed - azure

Question

I use IdentityServer4 to log in user. Client and identity server run on .net core 2.2.
I have these enviroments:
dev - using debbuging in visual studio
localhost - using IIS on my computer
staging - Azure
Production - Azure
On each env, is identity server as separate instance.
When I run client (dev),
with Identity (dev),
it WORKS.
When I run client (localhost/IIS),
with Identity (dev),
it do not WORKS.
When I run client (localhost/IIS),
with Identity (localhost/IIS),
it WORKS.
When I run client (dev),
with Identity (localhost/IIS),
it do not WORKS.
On azure it do now works on staging and also on prod.
It looks like Identity server and client must run under same user.
Here is error from logs:
warn: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[15]
'.AspNetCore.Correlation.OpenIdConnect.oaZfttaJrS8SNFK1sUNQ6PBDZ_32jcnjc-kXY8Fk5Dk' cookie not found.
info: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[4]
Error from RemoteAuthentication: Correlation failed..
fail: Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
An unhandled exception has occurred while executing the request.
System.Exception: An error was encountered while handling the remote login. ---> System.Exception: Correlation failed.
--- End of inner exception stack trace ---
at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Localization.RequestLocalizationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)
Here is my start Up class for client:
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
var logger = LogManager.GetLogger(Assembly.GetEntryAssembly(),
Assembly.GetExecutingAssembly().GetName().Name);
services.AddSingleton(logger);
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
logger.Info($"authority set to {Configuration["AuthorityUrl"]}");
services.AddAuthentication(options =>
{
options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect(options => {
options.Authority = Configuration["AuthorityUrl"];
options.ClientId = Configuration["ClientId"];
options.ClientSecret = Configuration["ClientSecret"];
options.SaveTokens = true;
options.TokenValidationParameters.NameClaimType = "name";
options.RequireHttpsMetadata = false;
});
IdentityModelEventSource.ShowPII = true;
services.AddMvc();
services.AddLocalization(options => options.ResourcesPath = "Translations");
services.AddMvc()
.AddViewLocalization(LanguageViewLocationExpanderFormat.Suffix)
.AddDataAnnotationsLocalization();
services.Configure<RequestLocalizationOptions>(options =>
{
var supportedCultures = new List<CultureInfo>
{
new CultureInfo("en-US"),
new CultureInfo("sk")
};
options.DefaultRequestCulture = new RequestCulture("sk");
options.SupportedCultures = supportedCultures;
options.SupportedUICultures = supportedCultures;
});
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
var log4NetFile = Configuration["log4netConfigFile"];
loggerFactory.AddLog4Net(log4NetFile);
if (!env.IsProduction())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Home/Error");
// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
app.UseHsts();
app.UseHttpsRedirection();
}
var supportedCultures = new[]
{
//new CultureInfo("en-US"),
new CultureInfo("sk"),
};
app.UseRequestLocalization(new RequestLocalizationOptions
{
DefaultRequestCulture = new RequestCulture("sk"),
// Formatting numbers, dates, etc.
SupportedCultures = supportedCultures,
// UI strings that we have localized.
SupportedUICultures = supportedCultures
});
app.UseStaticFiles();
app.UseCookiePolicy();
app.UseAuthentication();
//app.UseHttpsRedirection();
app.UseMvc(routes =>
{
routes.MapRoute(
name: "default",
template: "{controller=Home}/{action=Index}/{id?}");
});
app.UseRequestLocalization();
}
}
Edit:
I forgot to mention that I run Identity Server on Linux environment on Azure.
I think problem is with certificate. Do you know how can I verify it? I'm loading certificate from file.
Edit 2
This code solved my problem. I'm not sure about security, so I will not mark it as answer. Just as hotfix for now.
services.Configure<CookiePolicyOptions>(options =>
{
// This lambda determines whether user consent for non-essential cookies is needed for a given request.
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.None;
});