Test other approach.

backend/src/Squidex/Config/Authentication/IdentityServerServices.cs

@@ -5,7 +5,6 @@
 //  All rights reserved. Licensed under the MIT license.
 // ==========================================================================
 
-using System;
 using IdentityServer4;
 using IdentityServer4.AccessTokenValidation;
 using IdentityServer4.Hosting.LocalApiAuthentication;
@@ -15,7 +14,6 @@ using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Options;
 using Squidex.Hosting;
 using Squidex.Web;
 
@@ -41,16 +39,17 @@ namespace Squidex.Config.Authentication
             else
             {
                 authBuilder.AddLocalApi();
-
-                authBuilder.Services.Configure<LocalApiAuthenticationOptions>((c, options) =>
+                authBuilder.Services.AddOptions<LocalApiAuthenticationOptions>()
+                    .Configure<IUrlGenerator>((options, urlGenerator) =>
                     {
-                    options.ClaimsIssuer = GetAuthorityUrl(c);
-
+                        options.ClaimsIssuer = urlGenerator.BuildUrl(Constants.IdentityServerPrefix, false);
                         options.ExpectedScope = Constants.ApiScope;
                     });
             }
 
-            authBuilder.Services.AddSingleton<IPostConfigureOptions<OpenIdConnectOptions>>(c => new PostConfigureOptions<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
+            authBuilder.AddOpenIdConnect();
+            authBuilder.Services.AddOptions<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme)
+                .Configure<IUrlGenerator>((options, urlGenerator) =>
                 {
                     if (!string.IsNullOrWhiteSpace(identityOptions.AuthorityUrl))
                     {
@@ -58,7 +57,7 @@ namespace Squidex.Config.Authentication
                     }
                     else
                     {
-                    options.Authority = GetAuthorityUrl(c);
+                        options.Authority = urlGenerator.BuildUrl(Constants.IdentityServerPrefix, false);
                     }
 
                     options.ClientId = Constants.InternalClientId;
@@ -70,9 +69,7 @@ namespace Squidex.Config.Authentication
                     options.Scope.Add(Constants.ProfileScope);
                     options.Scope.Add(Constants.RoleScope);
                     options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
-            }));
-
-            authBuilder.AddOpenIdConnect();
+                });
 
             authBuilder.AddPolicyScheme(Constants.ApiSecurityScheme, Constants.ApiSecurityScheme, options =>
             {
@@ -89,12 +86,5 @@ namespace Squidex.Config.Authentication
 
             return authBuilder;
         }
-
-        private static string GetAuthorityUrl(IServiceProvider services)
-        {
-            var urlGenerator = services.GetRequiredService<IUrlGenerator>();
-
-            return urlGenerator.BuildUrl(Constants.IdentityServerPrefix, false);
-        }
     }
 }