Accessing Admin UI running on docker

Hello guys.

I’ve been trying to make this application to run inside multiple docker containers. I have already managed to do it but only with the Admin.Api project and the STS.Identity project, but I’m having problems with the Admin.UI project.

Everytime I try to access the url (http://localhost:9000) it shows this error:

OException: IDX20804: Unable to retrieve document from: ‘identity-server-sts:5000/.well-known/openid-configuration’. Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(string address, CancellationToken cancel) InvalidOperationException:` IDX20803: Unable to obtain configuration from: ‘identity-server-sts:5000/.well-known/openid-configuration’. Microsoft.IdentityModel.Protocols.ConfigurationManager<T>.GetConfigurationAsync(CancellationToken cancel)

I read that is possibly something related to the way I configure my network containers, but I tried everything I found on the internet and nothing worked.

I tried to instead using http://localhost:5000, I changed the url to connect to the following:

• http://(ip of the host):5000
• http://(ip of container hosting the STS.Identity Application):5000
• http://(container name, in my case is: identity-server-sts):5000
• (container name, in my case is: identity-server-sts):5000
• (container name, in my case is: identity-server-sts)

I dont know what should I do, do guys have any idea what this error is about.

Here is my Dockerfiles of each project and my docker-compose file:

Dockerfile - Admin.UI Project

Dockerfile.txt

Dockerfile - Admin.API Project

Dockerfile.txt

Dockerfile - STS.Identity Project

Dockerfile.txt

docker-compose file

docker-compose.txt

[bravecobra]

I think we have a case here of misunderstanding how docker and docker-compose works on a network level, together with the working of xip.io DNS resolving. Docker-compose basically starts up a mini virtual network.

networks:
 identity-host:
  driver: bridge

Each container can be considered as a tiny machine with its own IP address inside that network. If you want those little machine to work together you can refer to them by the name in the docker -compose. Look at the connection string of the database for instance. The connection string has the server db which matches the name of the docker container running SQL server. Note how each machine has a container name specified, for instance

container_name: skoruba-identityserver4-admin

Now, what does “localhost” mean from the perspective of a container? Well, as they can be considered as a little machine, then to each machine, localhost resolves to itself, not the localhost of your host machine (on which you run docker). Further, any address of xip.io resolves to localhost, thus depending on where you run that command, the machine responding will be the machine you run the command on. In our case here, the API and Admin UI, run on different “machines”, thus while http://127.0.0.1.xip.io:9000 resolves perfectly on Admin UI, it will not find http://127.0.0.1.xip.io:5000, because API is not running on the “machine” of the Admin UI. If you want to resolve from one docker image to another, you need to refer to them with their docker name. Each container may expose a port to the outside network and make it accessible to the “localhost” of your host machine. If you then call http://127.0.0.1.xip.io:5000 and http://127.0.0.1.xip.io:9000 on your host machine, each will resolve the correct machine, which is something that will not work if you try to resolve these on the individual containers themselves, since their localhost is their own “localhost”, not the “localhost” of the host.

Unfortunately, OAuth requires a fqdn (fully qualified domain name) for the issuer. That means we cannot use the container names (as they are not fqdn) hence the usage of xip.io instead of the docker name resolving.

If you ran the seeding of the database, based on localhost instead of 127.0.0.1.xip.io, then that configuration will not work inside a docker-compose env as the resolving will be incorrect when called from the docker host.

So, basically this is likely a case of incorrect configuration of both the seeding and the docker-compose file.

To confirm, could you try out the example of the dev branch? But keep in mind that you need create the migrations before building and running as the migrations as not part of the source code, you need to generate that yourself. Start from a fresh database and use the docker-compose.yml as provided in the branch. There are a lot of env variables configured in each container which are ALL required to have the whole thing work correctly.

That all being said, how would you get rid of that xip.io configuration?

1. You cannot use a simple edit of the hosts file. You would also need to add the extra_hosts option of docker-compose.
2. Another option would be to have a DNS server proxy running as an extra container, which would allow to redirect dns queries to a DNS server outside the mini docker network together with the dns option of docker-compose
3. Run the docker images on an orchestrator like kubernetes, which would allow scaling etc. but that’s a different beast to tackle.

We choose the xip.io configuration together with proper env variables as it would not require extra network configuration outside docker and thus just work out of the box for development purposes. This configuration is not meant to be used in production. Then again, you would not use docker-compose in a production environment anyway.

[terah]

Hi guys,

I’ve been trying to get this working for a couple of days now and I’m out of ideas. I think the issue is the same as that experienced in this issue and I think it’s a simple configuration issue. I’m setting this up on my mac with the plan to move it to a linux server once I’ve got it working.

I’ve replaced my FQD with example.com and I created a real DNS entry for that domain name resolving to public IP of my mac. Once deployed I’ll move the FQD to the public IP of my VPS.

When running the application in this exact configuration without TLS/HTTPS set in the Caddyfile (and changing the URLs everywhere to http) the whole stack works beautifully.

After changing the Caddy config to use HTTPS and setting the URLs everwhere (including the db) to HTTPS the STS application, API and swagger seems to be working fine.

There is a problem with the admin app where it throws the following exception anytime it’s accessed:

System.Net.Sockets.SocketException (111): Connection refused
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)

System.Net.Http.HttpRequestException: Connection refused
 ---> System.Net.Sockets.SocketException (111): Connection refused
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean allowHttp2, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.DiagnosticsHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)

System.IO.IOException: IDX20804: Unable to retrieve document from: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
 ---> System.Net.Http.HttpRequestException: Connection refused
 ---> System.Net.Sockets.SocketException (111): Connection refused
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean allowHttp2, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.DiagnosticsHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)

System.InvalidOperationException: IDX20803: Unable to obtain configuration from: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
 ---> System.IO.IOException: IDX20804: Unable to retrieve document from: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
 ---> System.Net.Http.HttpRequestException: Connection refused
 ---> System.Net.Sockets.SocketException (111): Connection refused
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean allowHttp2, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.DiagnosticsHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleChallengeAsyncInternal(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleChallengeAsync(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.ChallengeAsync(AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authentication.AuthenticationService.ChallengeAsync(HttpContext context, String scheme, AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Localization.RequestLocalizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at NWebsec.AspNetCore.Middleware.Middleware.CspMiddleware.Invoke(HttpContext context)
   at NWebsec.AspNetCore.Middleware.Middleware.MiddlewareBase.Invoke(HttpContext context)
   at NWebsec.AspNetCore.Middleware.Middleware.MiddlewareBase.Invoke(HttpContext context)
   at NWebsec.AspNetCore.Middleware.Middleware.MiddlewareBase.Invoke(HttpContext context)
   at NWebsec.AspNetCore.Middleware.Middleware.MiddlewareBase.Invoke(HttpContext context)
   at NWebsec.AspNetCore.Middleware.Middleware.MiddlewareBase.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

My hunch is that there is missing or incorrect configuration in the skoruba.identityserver4.admin container that doesn’t know how to work with the HTTPS configuration.

URLs:

• STS
  • PUBLIC: https://auth.example.com:443
  • INTERNAL: http://skoruba-identityserver4-sts-identity:80
• ADMIN:
  • PUBLIC: https://auth.example.com:9000
  • INTERNAL: http://skoruba-identityserver4-admin:80
• API:
  • PUBLIC: https://auth.example.com:5000
  • INTERNAL: http://skoruba-identityserver4-admin-api:80

Caddyfile:

# Redirect HTTP to HTTPS
http://auth.example.com:80 {
    redir https://{host}{uri}
}

# STS TLS Proxy to internal docker container
https://auth.example.com:443 {

    tls /data/certs/all-domains.crt /data/certs/all-domains.key

    log /data/log/prod-access.log
    errors /data/log/prod-error.log

    proxy / http://skoruba-identityserver4-sts-identity:80 {
        transparent
    }
}

# API TLS Proxy to internal docker container
https://auth.example.com:5000 {

    tls /data/certs/all-domains.crt /data/certs/all-domains.key

    log /data/log/prod-access.log
    errors /data/log/prod-error.log

    proxy / http://skoruba-identityserver4-admin-api:80 {
        transparent
    }
}

# ADMIN TLS Proxy to internal docker container
https://auth.example.com:9000 {

    tls /data/certs/all-domains.crt /data/certs/all-domains.key

    log /data/log/prod-access.log
    errors /data/log/prod-error.log


    proxy / http://skoruba-identityserver4-admin:80 {
        transparent
    }
}

Docker compose file:

version: '3.4'

services:
  skoruba.identityserver4.admin:
    image: ${DOCKER_REGISTRY-}skoruba-identityserver4-admin
#    ports:
#      - 9000:80
    build:
      context: .
      dockerfile: src/Skoruba.IdentityServer4.Admin/Dockerfile
    container_name: skoruba-identityserver4-admin
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - "ConnectionStrings__ConfigurationDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__PersistedGrantDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__IdentityDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__AdminLogDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__AdminAuditLogDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "AdminConfiguration__IdentityAdminBaseUrl=https://auth.example.com:9000"
      - "AdminConfiguration__IdentityAdminRedirectUri=https://auth.example.com:9000/signin-oidc"
      - "AdminConfiguration__IdentityServerBaseUrl=https://auth.example.com"
      - "AdminConfiguration__RequireHttpsMetadata=false"
      - "IdentityServerData__Clients__0__ClientUri=https://auth.example.com:9000"
      - "IdentityServerData__Clients__0__RedirectUris__0=https://auth.example.com:9000/signin-oidc"
      - "IdentityServerData__Clients__0__FrontChannelLogoutUri=https://auth.example.com:9000/signin-oidc"
      - "IdentityServerData__Clients__0__PostLogoutRedirectUris__0=https://auth.example.com:9000/signout-callback-oidc"
      - "IdentityServerData__Clients__0__AllowedCorsOrigins__0=https://auth.example.com:9000"
      - "IdentityServerData__Clients__1__RedirectUris__0=https://auth.example.com:5000/swagger/oauth2-redirect.html"
      - "Serilog__WriteTo__1__Args__connectionString=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
    command: dotnet Skoruba.IdentityServer4.Admin.dll /seed
    depends_on:
      - db
      - skoruba.identityserver4.sts.identity
    volumes:
      - "./shared/serilog.json:/app/serilog.json"
      - "./shared/identitydata.json:/app/identitydata.json"
      - "./shared/identityserverdata.json:/app/identityserverdata.json"
      - "./admin.appsettings.json:/app/appsettings.json"

  skoruba.identityserver4.admin.api:
    image: ${DOCKER_REGISTRY-}skoruba-identityserver4-admin-api
    build:
      context: .
      dockerfile: src/Skoruba.IdentityServer4.Admin.Api/Dockerfile
#    ports:
#      - 5000:80
    environment:
      - "AdminApiConfiguration__RequireHttpsMetadata=false"
      - "AdminApiConfiguration__ApiBaseUrl=https://auth.example.com:5000"
      - "AdminApiConfiguration__IdentityServerBaseUrl=https://auth.example.com"
      - "ConnectionStrings__ConfigurationDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__PersistedGrantDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__IdentityDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__AdminLogDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__AdminAuditLogDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
    container_name: skoruba-identityserver4-admin-api
    volumes:
      - "./shared/serilog.json:/app/serilog.json"
      - "./api.appsettings.json:/app/appsettings.json"

  skoruba.identityserver4.sts.identity:
    image: ${DOCKER_REGISTRY-}skoruba-identityserver4-sts-identity
#    ports:
#      - 80:80
    build:
      context: .
      dockerfile: src/Skoruba.IdentityServer4.STS.Identity/Dockerfile
    container_name: skoruba-identityserver4-sts-identity
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - "ConnectionStrings__ConfigurationDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__PersistedGrantDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "ConnectionStrings__IdentityDbConnection=Server=db;Port=5432;Database=IdentityServer4Admin;User Id=sa;Password=${DB_PASSWORD:-Password_123}"
      - "AdminConfiguration__IdentityAdminBaseUrl=https://auth.example.com:9000"
    depends_on:
      - db
    volumes:
      - "./shared/serilog.json:/app/serilog.json"
      - "./sts.appsettings.json:/app/appsettings.json"
      - "./auth.example.com.pfx:/app/certificate.pfx"

    # Don't know if this is needed..
    networks:
      default:
        aliases:
          - auth.example.com

  db:
    image: postgres:11
    ports:
      - 5432:5432
    container_name: skoruba-identityserver4-db
    environment:
      POSTGRES_USER: sa
      POSTGRES_PASSWORD: "${DB_PASSWORD:-Password_123}"
      POSTGRES_DB: IdentityServer4Admin
    volumes:
      - ./postgres:/var/lib/postgresql/data

  caddy:
    image: abiosoft/caddy:latest
    container_name: auth_proxy_caddy
    ports:
      - 80:80
      - 443:443
      - 5000:5000
      - 9000:9000
    volumes:
      - ./Caddyfile:/etc/Caddyfile
      - ./_letsencrypt/fullchain.pem:/data/certs/all-domains.crt
      - ./_letsencrypt/privkey.pem:/data/certs/all-domains.key
      - ./log:/data/log
    restart: unless-stopped

volumes:
  dbdata:
    driver: local

networks:
  default:
    driver: bridge

App Settings & Certificates:

{
    "ConnectionStrings": {
        "ConfigurationDbConnection": "Server=localhost; User Id=postgres; Database=is4admin; Port=5432; Password=postgres; SSL Mode=Prefer; Trust Server Certificate=true",
        "PersistedGrantDbConnection": "Server=localhost; User Id=postgres; Database=is4admin; Port=5432; Password=postgres; SSL Mode=Prefer; Trust Server Certificate=true",
        "IdentityDbConnection": "Server=localhost; User Id=postgres; Database=is4admin; Port=5432; Password=postgres; SSL Mode=Prefer; Trust Server Certificate=true"
    },
    "DatabaseProviderConfiguration": {
        "ProviderType": "PostgreSQL"
    },
    "CertificateConfiguration": {

        "UseTemporarySigningKeyForDevelopment": false,

        "CertificateStoreLocation": "LocalMachine",
        "CertificateValidOnly": true,

        "UseSigningCertificateThumbprint": false,
        "SigningCertificateThumbprint": "",

        "UseSigningCertificatePfxFile": true,
        "SigningCertificatePfxFilePath": "/app/certificate.pfx",
        "SigningCertificatePfxFilePassword": "my-cert-pass",

        "UseValidationCertificatePfxFile": true,
        "ValidationCertificatePfxFilePath": "/app/certificate.pfx",
        "ValidationCertificatePfxFilePassword": "my-cert-pass",

        "UseValidationCertificateThumbprint": false,
        "ValidationCertificateThumbprint": ""
    },
    "RegisterConfiguration": {
        "Enabled": true
    },
    "ExternalProvidersConfiguration": {
        "UseGitHubProvider": false,
        "GitHubClientId": "",
        "GitHubClientSecret": ""
    },
    "SmtpConfiguration": {
        "Host": "",
        "Login": "",
        "Password": ""
    },
    "SendgridConfiguration": {
        "ApiKey": "",
        "SourceEmail": "",
        "SourceName": ""
    },
    "LoginConfiguration": {
        "ResolutionPolicy": "Username"
    },
    "AdminConfiguration": {
        "PageTitle": "Skoruba IdentityServer4",
        "HomePageLogoUri": "/images/skoruba-icon.png",
        "FaviconUri": "/favicon.ico",
        "IdentityAdminBaseUrl": "http://localhost:9000",
        "AdministrationRole": "SkorubaIdentityAdminAdministrator"
    },
  "CultureConfiguration": {
    "Cultures": [],
    "DefaultCulture": null
  }
}

URLs in seeded data:

update "PersistedGrants" set "Data" = REPLACE("Data", 'http://127.0.0.1.xip.io', 'https://auth.example.com');
update "ClientCorsOrigins" set "Origin"  = REPLACE("Origin", 'http://127.0.0.1.xip.io', 'https://auth.example.com');
update "ClientPostLogoutRedirectUris" SET "PostLogoutRedirectUri" = REPLACE("PostLogoutRedirectUri", 'http://127.0.0.1.xip.io', 'https://auth.example.com');
update "ClientRedirectUris" SET "RedirectUri" = REPLACE("RedirectUri", 'http://127.0.0.1.xip.io', 'https://auth.example.com');