Crowd + Nginx + SSL - Not Working

[Jakob Jensen]

Hi everybody

Im using JIRA and Confluence. Im trying to set it up with Crowd with the url www.examle.com/crowd

I have a Ubuntu Server and JIRA and Confluence is working over SSL but cant get Crowd to work.

Im getting different errors when trying to get it to work.

My server.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Server port="8020" shutdown="SHUTDOWN">

    <Service name="Catalina">

        <Connector port="8095" 
           acceptCount="100" 
    connectionTimeout="20000" 
    disableUploadTimeout="true" 
    enableLookups="false" 
    maxHttpHeaderSize="8192" 
    maxThreads="150" 
    minSpareThreads="25" 
    URIEncoding="UTF-8"
    redirectPort="8095" 
    useBodyEncodingForURI="true" 
    
    scheme="https"
    proxyName="examle.com/"
    proxyPort="8095"/>

        <Engine defaultHost="localhost" name="Catalina">
            <Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/>
        </Engine>

        <!-- To connect to an external web server (typically Apache) -->
        <!-- Define an AJP 1.3 Connector on port 8009 -->
        <!-- 
            <Connector port="8009" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />
       <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           keystoreFile="${user.home}/.keystore" keystorePass="changeit"
           keyAlias="" keyPass=""/> 
    </Service>-->

    <!-- Security listener. Documentation at /docs/config/listeners.html
    <Listener className="org.apache.catalina.security.SecurityListener" />
    -->
    <!--APR library loader. Documentation at /docs/apr.html -->
    <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
    <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
    <Listener className="org.apache.catalina.core.JasperListener" />
    <!-- Prevent memory leaks due to use of particular java/javax APIs-->
    <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
    <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
    <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />

</Server>

crowd-init.properties

###############
##           ##
##  UNIX     ##
##           ##
###############
## On Unix-based operating systems, uncomment the following
## line and set crowd.home to a directory Crowd should use to
## store its configuration.
crowd.home=/var/crowd-home

build.properties

# Modify the attributes of this file to quickly adjust the deployment values of Crowd.
# The Hibernate database dialect to use. See https://confluence.atlassian.com/display/CROWD/Connecting+Crowd+to+a+Database
hibernate.dialect=org.hibernate.dialect.HSQLDialect
# The Hibernate transaction factory to use. See https://confluence.atlassian.com/display/CROWD/Configuring+Crowd
hibernate.transaction.factory_class=org.hibernate.transaction.JDBCTransactionFactory
# The http port you wish to run crowd from, ie: http://localhost:8095/crowd
crowd.tomcat.connector.port=8095
# Tomcat requires a unique port for shutdown
crowd.tomcat.shutdown.port=8020
# Crowd context root
crowd.url=http://localhost:8095/crowd
# Demo context root
demo.url=http://localhost:8095/demo
# OpenID server context root
openidserver.url=http://localhost:8095/openidserver

And my nginx.conf

user www-data;
worker_processes 4;
pid /var/run/nginx.pid;



events {
    worker_connections 768;
    # multi_accept on;
}

http {

    ##
    # Basic Settings
    ##
server {
    server_name example.com;
    listen 80;
     location /crowd {
            
        proxy_pass http://localhost:8095;
            proxy_set_header    Host            $host;
            proxy_set_header    X-Real-IP       $remote_addr;
            proxy_set_header    X-Forwarded-for $remote_addr;
            port_in_redirect off;
            proxy_redirect   https://www.example.com/ /;
        #rewrite ^ https://www.example.com/crowd permanent;
    #proxy_set_header X-Forwarded-Host $host;  
        #proxy_set_header X-Forwarded-Server $host;  
        #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        #rewrite ^ https://www.example.com/crowd permanent;

    }
location /jira {  
        proxy_set_header X-Forwarded-Host $host;  
        proxy_set_header X-Forwarded-Server $host;  
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        rewrite ^ https://www.example.com/jira permanent;  
      }
location /confluence {  
        proxy_set_header X-Forwarded-Host $host;  
        proxy_set_header X-Forwarded-Server $host;  
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        rewrite ^ https://www.example.com/confluence permanent;  
      }  
}
server {
    listen 443 ssl;
    ssl on;
    server_name www.example.com;
    ssl_certificate /etc/nginx/ssl/JiraConfCert.crt;
    ssl_certificate_key /etc/nginx/ssl/JiraConfKey.key;
    
    client_max_body_size 10M;
    location /crowd {
      proxy_set_header X-Forwarded-Host $host;  
      proxy_set_header X-Forwarded-Server $host;  
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
      proxy_pass http://IPADRESS:8095/crowd;  
    }
     location /jira {  
      proxy_set_header X-Forwarded-Host $host;  
      proxy_set_header X-Forwarded-Server $host;  
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
      proxy_pass http://IPADRESS:8080/jira;  
    }
location /confluence {  
      proxy_set_header X-Forwarded-Host $host;  
      proxy_set_header X-Forwarded-Server $host;  
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
      proxy_pass http://IPADRESS:8090/confluence;  
    } 
}
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # nginx-naxsi config
    ##
    # Uncomment it if you installed nginx-naxsi
    ##

    #include /etc/nginx/naxsi_core.rules;

    ##
    # nginx-passenger config
    ##
    # Uncomment it if you installed nginx-passenger
    ##
    
    #passenger_root /usr;
    #passenger_ruby /usr/bin/ruby;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}


#mail {
#    # See sample authentication script at:
#    # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
# 
#    # auth_http localhost/auth.php;
#    # pop3_capabilities "TOP" "USER";
#    # imap_capabilities "IMAP4rev1" "UIDPLUS";
# 
#    server {
#        listen     localhost:110;
#        protocol   pop3;
#        proxy      on;
#    }
# 
#    server {
#        listen     localhost:143;
#        protocol   imap;
#        proxy      on;
#    }
#}

Hope someone can help me.

Regards

Jakob

[Gabriele Turelli]

It may be a little late,
But I had the same problem and i figured out why it happens and how to fix it.

First, install crowd on the default port, and when you're done, log in and trust the IP your proxy request is coming from.
Yes, even it is from localhost. Go to the Gear Icon > Trusted Proxy Servers

When you do that, follow this configuration to get it working.
https://answers.atlassian.com/questions/236755

Careful to add

secure="true"

to your server.xml if you want the SSO cookie to be working under https (and also flagged as "secure")
Remember that any app that uses crowd as sso needs to have secure flag enabled


Wish you luck!