Problems with Crowd token validation when Confluence is sitting behind an Apache proxy.

Lars Kellogg-St

We have Confluence sitting behind an Apache proxy running on the same host:

<Location / >
        ProxyPass          http://127.0.0.1:8080/
        ProxyPassReverse   http://127.0.0.1:8080/
</Location>

When Confluence attempts to validate a Crowd SSO token, it sets the remote-address validation-factor to "127.0.0.1", like this:

<validation-factors>
    <validation-factor>
        <name>remote_address</name>
        <value>127.0.0.1</value>
    </validation-factor>
    <validation-factor>
        <name>X-Forwarded-For</name>
        <value>96.1.2.3, 96.1.2.3</value>
    </validation-factor>
</validation-factors>

Here, the actual remote client is 96.1.2.3. The client connects to Crowd and to Confluence through a front-end proxy; the request arriving at Crowd has these headers:

X-Forwarded-For: 10.243.22.47, 10.243.21.54

Where 10.243.22.47 is the address of the Confluence host. The requests received by Apache on the Confluence host look like this:

X-Forwarded-For: 96.1.2.3

And when the request gets received by Tomcat, it looks like this:

X-Forwarded-For: 96.1.2.3, 96.1.2.3

Is there any way to get this to work? If I understand how things are working (and I may not!), Crowd and Confluence can only do SSO successfully if Confluence is receiving requests directly from clients -- i.e., with no intervening proxies. Is there any way to get Confluence to use the correct remote-address?

Jobin Kuruvilla [Adaptavist]

Have you looked at configuring trusted proxies?

http://confluence.atlassian.com/display/CROWD/Configuring+Trusted+Proxy+Servers