Grouper Users - Open Discussion List

[Darren Boss <>]

This is our first deployment and we are also new to Kubernetes as well so there is only one nginx ingress controller and only one container running the ui at the current time. I know how to implement session affinity when we scale up but that's not the problem right now. I will admit that I may not be seeing all the logs as I am relying on the Unicon grouper Dockerfiles to build my images so it's easy to acess the logs that are being written to stdout. I've exec'd into the container once to take a look at other logs in case they were not being sent to stdout, coulnd't see any issues but I will double check that this is not the case.

I'll check on the X-Grouper-path as you suggested. Thanks for the quick response.

When I use port-forward, it's more like using an ssh tunnel and I'm bypassing the nginx proxy when I do that.

On Mon, Sep 18, 2017 at 10:13 AM Hyzer, Chris <> wrote:

> Full disclousure, I'm running Grouper in containers under Kubernetes with an nginx ingress

> controller which is terminating TLS at the ingress. When I use "kubectl port-forward pod-name"

> and access the ui over localhost:8080 I have no issues in accessing the interface.

 

So you are saying it works when you are not load balancing?  But it doesn’t work with load balancing?  Is the load balancing sticky by cookie?  Does it work if it is load balancing with one node in the pool?

 

What the X-Grouper-path response http header coming back from the server?

 

Are you sure there are no errors in any of the logs?

 

Thanks

Chris

 

 

From: [mailto:] On Behalf Of Darren Boss
Sent: Monday, September 18, 2017 9:58 AM
To:
Subject: [grouper-users] New UI problems with reverse proxy

 

Question about the New UI and OWASP csrfguard and accessing the UI behind a nginx reverse proxy.

 

Took me a little while to figure out the additions to make to Tomcat to fix the major issue of accessing the UI after which the admin ui works. This is a common solution when running tomcat behind a reverse proxy. I have another tweak for Jetty that accomplished the same.

 

<Valve className="org.apache.catalina.valves.RemoteIpValve"

        internalProxies="my.nginx.proxy.address"

        remoteIpHeader="x-forwarded-for"

        requestAttributesEnabled="true"

        protocolHeader="x-forwarded-proto"

        protocolHeaderHttpsValue="https"/>

 

Now when I click on any link in the new ui I end up in an infinite redirect loop with &csrfExtraParam=xyz being added to the existing url on every redirect. I've tried to search through the mailing list to find a resolution. I know there are lots of deployments behind reverse proxies so this should be a solved issue.

 

Full disclousure, I'm running Grouper in containers under Kubernetes with an nginx ingress controller which is terminating TLS at the ingress. When I use "kubectl port-forward pod-name" and access the ui over localhost:8080 I have no issues in accessing the interface.

 

I'm also incredably new to deploying grouper but had been using the deployment at Duke when I was a staff member there and I believe their deployment was running under OpenShift so probably a similar deployment to what I'm doing now.

--

Darren Boss

Senior Programmer/Analyst
Programmeur-analyste principal

(o) 416.228.1234 x 230

(c) 919.525.0083

155 University Ave, Suite 302 Toronto, ON M5H 3B7
www.computecanada.ca / www.calculcanada.ca 
@ComputeCanada 

--

Darren Boss

Senior Programmer/Analyst
Programmeur-analyste principal

(o) 416.228.1234 x 230

(c) 919.525.0083

155 University Ave, Suite 302 Toronto, ON M5H 3B7
www.computecanada.ca / www.calculcanada.ca 
@ComputeCanada