Grouper Users - Open Discussion List

["Hyzer, Chris" <>]

> Full disclousure, I'm running Grouper in containers under Kubernetes with an nginx ingress

> controller which is terminating TLS at the ingress. When I use "kubectl port-forward pod-name"

> and access the ui over localhost:8080 I have no issues in accessing the interface.

 

So you are saying it works when you are not load balancing?  But it doesn’t work with load balancing?  Is the load balancing sticky by cookie?  Does it work if it is load balancing with one node in the pool?

 

What the X-Grouper-path response http header coming back from the server?

 

Are you sure there are no errors in any of the logs?

 

Thanks

Chris

 

 

From: [mailto:] On Behalf Of Darren Boss
Sent: Monday, September 18, 2017 9:58 AM
To:
Subject: [grouper-users] New UI problems with reverse proxy

 

Question about the New UI and OWASP csrfguard and accessing the UI behind a nginx reverse proxy.

 

Took me a little while to figure out the additions to make to Tomcat to fix the major issue of accessing the UI after which the admin ui works. This is a common solution when running tomcat behind a reverse proxy. I have another tweak for Jetty that accomplished the same.

 

<Valve className="org.apache.catalina.valves.RemoteIpValve"

        internalProxies="my.nginx.proxy.address"

        remoteIpHeader="x-forwarded-for"

        requestAttributesEnabled="true"

        protocolHeader="x-forwarded-proto"

        protocolHeaderHttpsValue="https"/>

 

Now when I click on any link in the new ui I end up in an infinite redirect loop with &csrfExtraParam=xyz being added to the existing url on every redirect. I've tried to search through the mailing list to find a resolution. I know there are lots of deployments behind reverse proxies so this should be a solved issue.

 

Full disclousure, I'm running Grouper in containers under Kubernetes with an nginx ingress controller which is terminating TLS at the ingress. When I use "kubectl port-forward pod-name" and access the ui over localhost:8080 I have no issues in accessing the interface.

 

I'm also incredably new to deploying grouper but had been using the deployment at Duke when I was a staff member there and I believe their deployment was running under OpenShift so probably a similar deployment to what I'm doing now.

--

Darren Boss

Senior Programmer/Analyst
Programmeur-analyste principal

(o) 416.228.1234 x 230

(c) 919.525.0083

155 University Ave, Suite 302 Toronto, ON M5H 3B7
www.computecanada.ca / www.calculcanada.ca 
@ComputeCanada