Proxy OIDC Discovery and JWKS in .NET with HttpDocumentRetriever

Inject the proxy-aware HttpClient into the retriever used by Microsoft.IdentityModel's configuration lookup, keeping refresh and validation policy intact.

var handler = new HttpClientHandler
{
    Proxy = new WebProxy("http://proxy.example:8080"),
    UseProxy = true
};
var http = new HttpClient(handler);
var documents = new HttpDocumentRetriever(http);

var configuration = await OpenIdConnectConfigurationRetriever.GetAsync(
    "https://issuer.example/.well-known/openid-configuration",
    documents,
    cancellationToken);

HttpDocumentRetriever comes from Microsoft.IdentityModel.Protocols; OpenIdConnectConfigurationRetriever comes from its OpenIdConnect package. Keep the HTTP client alive for its workload. For public discovery and JWKS URLs where public intermediaries are permitted, the HTTP proxy list provides candidates for the WebProxy URL.

The lookup fetches discovery and then uses the same supplied retriever for jwks_uri, when present. Those URLs can have different hosts, and the proxy must permit both.

For proxy authentication, configure WebProxy's account before construction. It is not an issuer client secret.

In a long-running authentication service, supply this retriever to the supported cache/refresh arrangement rather than downloading configuration for every incoming request. Keep issuer, HTTPS trust and token-validation policy independent of this transport selection.

Artihkkalat mat laktásit