Application Links SSL and Reverse Proxy

Question

Hello People,

I'm wondering if anyone can help me solve that problem because I have tried everything and sill cannot find proper resolution.

Currently I use this following configuration example With a reverse proxy I use Sophos WAF setup so all incoming connections that hits  WAN interface with query for kb.testdomain.com is redirected to internal confluence server and sd.testdomain.com redirected to Jira server
Confluence is currently configured to use SSL and port 8888  and Jira port 8889
All custom generated certificates and Root CA is already imported to default Java store as well as to keystore used by Confluence and Jira. 
This is my current server.xml config:
Confluence:

<Connector port="8888" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" SSLEnabled="true"
URIEncoding="UTF-8" keyAlias="kb.testdomain.com" keyPass="something"
keystoreFile="/etc/ssl/cert.p12" keystorePass="something"
proxyName="kb.testdomain.com" proxyPort="443"

Jira

At his point every user who is connected to those instances from external network is able to login edit pages add pages etc, so everything works fine.

Problem is when I want to create Application link between those to applications.
I was  able to add links but than I get this error  in Confluence:

Invalid OAuth signature
We couldn't connect to Jira, possibly because that instance is behind a misconfigured proxy.

and from Confluence
Invalid OAuth signature
We couldn't connect to Confluence, possibly because that instance is behind a misconfigured proxy.

Here is my current application links setup from following applications
From Confluence:
Application URL sd.testdomain.com:8889
Display URL sd.testdomain.com
Server Base URL sd.testdomain.com

From Jira
Application URL kb.testdomain.com:8888
Display URL kb.testdomain.com
Server Base URL kb.testdomain.com

I have also tried point to server IP but result was that same.
So far I was able to figured out that if I remove from server.xml following lines application links works perfect

proxyName="sd.testdomain.com" proxyPort="443"
proxyName="kb.testdomain.com" proxyPort="443"

But after removing above lines every user that is connecting to those applications in not able to add, edit pages etc. anymore.

I have no idea what else could be done here to fix that issue and I will really appreciate if someone could help me solve that.

Thanks 
Raf

imsty · Answer

How to create an unproxied application link this one helped me I use contextpath, not subdomain, though - created new connector on new port (step 1.) accessed jira and confluence, locally using new port: http://localhost:/ changed base URL to http://localhost:/ created app links using http://localhost:/ changed base URL back to https:///

Rafal Niznik · Answer

Based URL and proxy setting are correct as follows:

proxyName="sd.testdomain.com"   and base URL is sd.testdomain.com
proxyName="kb.testdomain.com"  and base URL is  kb.testdomain.com

I run Confluence 6.13.0 and JIra 7.13.0 so there should not be  a issue.

So basically I'm able to get through first steps when creating AL between those two because they can see each other and fills up all field automatically

This is how I configure Application Links from Concfluence to Jira
Under application links on Confluence I enter following URL
https://sd.testdomain.com:8889

After clicking on create application links followed data is automatically filled out

You are creating a link from:
Display URL: https://sd.testdomain.com
Application URL: https://sd.testdomain.com:8889
Name: PM
Application: Jira

To this application:
Display URL: https://kb.testdomain.com
Application URL: https://kb.testdomain.com
Name: KB
Application: Confluence

After clicking on continue it redirect me to Jira and this is how it should be but than I get this messages:

It has not been possible to retrieve the required information from https://kb.testdomain.com Therefore the link cannot be created.
Click Continue to be redirected back to https://kb.testdomain.com Click Close to remain here.

I think this is because Jira is trying connect back to https://kb.testdomain.com instead of https://kb.testdomain.com:8888  and this is the problem here.

Later when I'm redirected back to AL on Confluence server I see this message:
Application Link 'SD' was created successfully locally but the reciprocal link was not created. Please review the configuration using the Edit option.

If I edit option on confluence and jire and select that same auth I see green arrows but at the top I see following message

Invalid OAuth signature

We couldn't connect to SD possibly because that instance is behind a misconfigured proxy.

But proxy settings are configured correctly

So to me it looks like jira is trying connect back to https://kb.testdomain.com instead https://kb.testdomain.com:8888 and this where problem exists in my opinion.

Keep in mind the following server xml configuration

Confluence:

<Connector port="8888" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" SSLEnabled="true"
URIEncoding="UTF-8" keyAlias="kb.testdomain.com" keyPass="something"
keystoreFile="/etc/ssl/cert.p12" keystorePass="something"
proxyName="kb.testdomain.com" proxyPort="443"

Jira

When I remove proxyName, proxyPort  and change base URL to kb.testdomain.com:8888 and sd.testdomain.com:8889 application links works perfect .

But than all incoming connection from WAF because there is not proxy configuration on server.xml  users are not able to add, edit, remote pages etc. 
If I reverse and add proxyName, proxyPort than WAF connection works perfectly but Application Link is broken again and I have not clue how to fix that :-(

Rafal Niznik · Answer

Still not luck so far.

Any other ideas?