How do I deploy idserver in a cluster and whether cluster mode is supported

[AcTeemo]

I deploy it in cluster mode, but it didn't worked. could you give me some help?

[simpleidserver]

Hello,

Could you please provide more details about the infrastructure you are trying to deploy?

• Are you trying to deploy SID with Kubernetes?
• Are you trying to deploy SID on an Ubuntu Server and using NGINX as a reverse proxy?

Kind regards,

SID

[AcTeemo]

Hello,

Could you please provide more details about the infrastructure you are trying to deploy?

• Are you trying to deploy SID with Kubernetes?
• Are you trying to deploy SID on an Ubuntu Server and using NGINX as a reverse proxy?

Kind regards,

SID

I deployed SID on three Windows servers, used the same database as a cache, and then used an NGINX server for reverse proxy.
However, I found that the authentication on each server is independent, which means that after I authenticate on Server A, I am still unauthenticated on Server B.

[simpleidserver]

The configuration of the IdentityServer project is correct and should work in a cluster environment. However, the administration website is not configured to use a shared authentication cookie. I made some modifications in the master branch to support this scenario.

In the meantime, you can make the following changes in the Program.cs file of the "SimpleIdServer.IdServer.Website.Startup" project. Add the following code before "AddSIDWebsite" and replace "COMMON_PATH" with the path of a shared directory accessible by your Windows Servers.

var path = "COMMON_PATH";
var b = builder.Services.AddDataProtection();
b.PersistKeysToFileSystem(new DirectoryInfo(path));

For more information refer to the official documentation : https://learn.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-8.0

Could you let me know if this works?

KR,
SID

[AcTeemo]

Thank you for your response. I have a single-instance deployment of the administration website, which is working fine. I have deployed IdentityServer on three Windows servers and am using Nginx as a reverse proxy. When I access it, I encounter the following error: It is impossible to validate the anti-forgery token. Close all windows and try again. The issue does not occur when I enable only one instance. Additionally, I have no problems when I simulate a cluster by running three instances on a single machine using different ports. The problem only arises when they are independently deployed on three different machines. I look forward to your reply.

[AcTeemo]

I guess it should be a problem with the anti-forgery token. This token is generated by Server A and then accessed by Server B when submitted, so the validation fails.

[AcTeemo]

I've found a solution: enable the sticky module in Nginx or use the ip_hash mode to ensure that the current session is always directed to the same server.

I guess it should be a problem with the anti-forgery token. This token is generated by Server A and then accessed by Server B when submitted, so the validation fails.

[simpleidserver]

We will update the documentation in release 5.0.2 to explain the various issues that may occur when hosting the application in a cluster.

Thank you for your feedback.

KR
SID