App ID login flow removes ingress service root path after successful login

Question

I'm facing the following error while running Node.js WEB app on IBM Cloud Kubernetes with AppId: The WEB app is accessed via ingress URL: https://<host url>/ar-studio

ar-studio is the backend service path as is configured in ingress. index.html has the following HTML line

<div class="button"><a id="signin" href="protected/protected.html" title="Sign In to service">Sign In to service</a></div>

1. User clicks on the Sign In link and IBM AppId login widget is displayed with the correct redirect uri.
2. User successfully logs in (using cloud directory), and the client page is redirected to https://<host url>/protected/protected.html instead of using the service root path https://<host url>/ar-studio/protected/protected.html

How can I fix it so the browser will be redirected to https://<host url>/ar-studio/protected/protected.html ? The app works great without ingress, on my local docker engine. Here are the relevant ingress yaml fields (some values replaced with ... for security reasons):

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.bluemix.net/client-max-body-size: size=400m;
    ingress.bluemix.net/rewrite-path: |
      serviceName=ar-studio rewrite=/;
    nginx.ingress.kubernetes.io/x-forwarded-prefix: "True"
  creationTimestamp: "..."
  generation: 20
  name: ...
  namespace: ...
  resourceVersion: "..."
  selfLink: ...
  uid: ...
spec:
  rules:
  - host: dev.cvar.eu-gb.containers.appdomain.cloud
    http:
      paths:
      - backend:
          serviceName: ar-studio
          servicePort: http
        path: /ar-studio/
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - dev.cvar.eu-gb.containers.appdomain.cloud
    secretName: ...
status:
  loadBalancer:
    ingress:
    - ip: ...

Answer 1

I imagine you'd need to add the bluemix annotation for App ID to your ingress resource, ingress.bluemix.net/appid-auth - instructions at https://cloud.ibm.com/docs/containers?topic=containers-ingress_annotation#appid-auth