title: AspNetCore Azure AD Connect Callback URL is http, not https
body: <p>I have a AspNet Core 2.0 App which authorizes users with Azure AD using the OpenIdConnect API. The callback uris of the Azure App Entry are defined as <a href="https://localhost:44369/signin-oidc" rel="noreferrer">https://localhost:44369/signin-oidc</a> and <a href="https://domain.tld/signin-oidc" rel="noreferrer">https://domain.tld/signin-oidc</a>. When I deploy my app on localhost with IIS Express everything works fine and I can authenticate users correctly.</p>
  
  <p>When I deploy my app to a Linux system with Nginx configured as a reverse proxy to the app authentication doesn't work. Azure AD shows the following error message:</p>
  
  <blockquote>
    <p>AADSTS50011: The reply address '<a href="http://domain.tld/signin-oidc" rel="noreferrer">http://domain.tld/signin-oidc</a>' does
    not match the reply addresses configured for the application. More
    details: not specified</p>
  </blockquote>
  
  <p>Obviously my app tells Azure AD to redirect back to the http address and Azure AD refuses to do so (fortunately). I guess the problem is that my app thinks it uses http because it listens on <a href="http://localhost:5000/" rel="noreferrer">http://localhost:5000/</a> for the reverse proxy.</p>
  
  <pre><code>public void Configure(string name, OpenIdConnectOptions options)
  {
      options.ClientId = _azureOptions.ClientId;
      options.Authority = $"{_azureOptions.Instance}{_azureOptions.TenantId}";
      options.UseTokenLifetime = true;
      options.CallbackPath = _azureOptions.CallbackPath;
      options.RequireHttpsMetadata = true;
  }
  </code></pre>
  
  <p>This is the code I use to configure OpenIdConnect. Specifying an absolute path for CallbackPath yields in an exception. Is there any other way to tell OpenIdConnect to allways use https for the CallbackPath?</p>
  
  <p>In case my Nginx is not configured correctly this is part of my configuration:</p>
  
  <pre><code>location / {
          # redirect to ASP.NET application
          proxy_pass         http://localhost:5000;
          proxy_http_version 1.1;
          proxy_set_header   Upgrade $http_upgrade;
          proxy_set_header   Connection keep-alive;
          proxy_set_header   Host $http_host;
          proxy_cache_bypass $http_upgrade;
  }
  </code></pre>
  
  <p>Any help is highly appreciated!</p>