title: Identity Server 4 Client sometime stuck on consent screen in load balancer environment
body: <p>Some times it works okay, but in many times it stucks on consent screen and after trying again and again it throws error:</p>
  <blockquote>
  <p>Error from RemoteAuthentication: Message contains error:
  'invalid_grant', error_description: 'error_description is null',
  error_uri: 'error_uri is null'.. 2022-04-26 03:14:41.099 +00:00 [ERR]
  An unhandled exception has occurred while executing the request.
  System.Exception: An error was encountered while handling the remote
  login.  ---&gt;
  Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolException:
  Message contains error: 'invalid_grant', error_description:
  'error_description is null', error_uri: 'error_uri is null'.    at
  Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage
  tokenEndpointRequest)    at
  Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()</p>
  </blockquote>
  <p>Identity Code</p>
  <pre><code>services.AddDataProtection()
      .PersistKeysToDbContext&lt;DataprotectionContext&gt;()
      .SetApplicationName(&quot;authapplication&quot;);
  
  services
      .AddDefaultIdentity&lt;AuthUser&gt;(options =&gt; options.SignIn.RequireConfirmedAccount = true)
      .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;();
  //services.AddOidcStateDataFormatterCache();
  
  X509Certificate2 cert = new X509Certificate2(&quot;****&quot;, &quot;****&quot;);
  services
      .AddIdentityServer(
          options =&gt;
          {
              options.Events.RaiseErrorEvents = true;
              options.Events.RaiseFailureEvents = true;
              options.Events.RaiseInformationEvents = true;
              options.Events.RaiseSuccessEvents = true;
          })
      .AddConfigurationStore(options =&gt;
      {
          options.ConfigureDbContext =
              builder =&gt; builder.UseMySql(
                  connectionString,
                  ServerVersion.AutoDetect(connectionString),
                  sql =&gt; sql.MigrationsAssembly(typeof(Startup).Assembly.GetName().Name));
      })
      .AddAspNetIdentity&lt;AuthUser&gt;()
      .AddSigningCredential(cert)
      .AddProfileService&lt;ProfileService&gt;();
  
  services.AddAuthentication();
  </code></pre>
  <p>Client Code</p>
  <pre><code>services.AddAuthentication(options =&gt;
  {
      options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
      options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
  })
  .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme,
      options =&gt;
      {
          options.Cookie.Name = &quot;cookies&quot;;
      })
  .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =&gt;
  {
      options.Authority = serviceSettings.Value.Auth.TrimEnd('/');
  
      options.ClientId = &quot;auth-admin-client&quot;;
      options.ClientSecret = &quot;secret&quot;;
      options.ResponseType = &quot;code&quot;;
      options.RequireHttpsMetadata = true;
      options.BackchannelHttpHandler = new HttpClientHandler
      {
          ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
      };
  
      options.SaveTokens = true;
  
      options.Scope.Add(&quot;offline_access&quot;);
  });
  </code></pre>
  <p>I have used this in configure for client and server:</p>
  <pre><code>app.Use((context, next) =&gt; { context.Request.Scheme = &quot;https&quot;; return next(); });
  var fordwardedHeaderOptions = new ForwardedHeadersOptions
  {
      ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
  };
  fordwardedHeaderOptions.KnownNetworks.Clear();
  fordwardedHeaderOptions.KnownProxies.Clear();
  app.UseForwardedHeaders(fordwardedHeaderOptions);
  app.UseDeveloperExceptionPage();
  </code></pre>