Crowd + Nginx + SSL - Not Working

Hi everybody

Im using JIRA and Confluence. Im trying to set it up with Crowd with the url www.examle.com/crowd

I have a Ubuntu Server and JIRA and Confluence is working over SSL but cant get Crowd to work.

Im getting different errors when trying to get it to work.

My server.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Server port="8020" shutdown="SHUTDOWN">

    <Service name="Catalina">

        <Connector port="8095" 
           acceptCount="100" 
    connectionTimeout="20000" 
    disableUploadTimeout="true" 
    enableLookups="false" 
    maxHttpHeaderSize="8192" 
    maxThreads="150" 
    minSpareThreads="25" 
    URIEncoding="UTF-8"
    redirectPort="8095" 
    useBodyEncodingForURI="true" 
    
    scheme="https"
    proxyName="examle.com/"
    proxyPort="8095"/>

        <Engine defaultHost="localhost" name="Catalina">
            <Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/>
        </Engine>

        <!-- To connect to an external web server (typically Apache) -->
        <!-- Define an AJP 1.3 Connector on port 8009 -->
        <!-- 
            <Connector port="8009" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />
       <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           keystoreFile="${user.home}/.keystore" keystorePass="changeit"
           keyAlias="" keyPass=""/> 
    </Service>-->

    <!-- Security listener. Documentation at /docs/config/listeners.html
    <Listener className="org.apache.catalina.security.SecurityListener" />
    -->
    <!--APR library loader. Documentation at /docs/apr.html -->
    <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
    <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
    <Listener className="org.apache.catalina.core.JasperListener" />
    <!-- Prevent memory leaks due to use of particular java/javax APIs-->
    <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
    <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
    <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />

</Server>

crowd-init.properties

###############
##           ##
##  UNIX     ##
##           ##
###############
## On Unix-based operating systems, uncomment the following
## line and set crowd.home to a directory Crowd should use to
## store its configuration.
crowd.home=/var/crowd-home

build.properties

# Modify the attributes of this file to quickly adjust the deployment values of Crowd.
# The Hibernate database dialect to use. See https://confluence.atlassian.com/display/CROWD/Connecting+Crowd+to+a+Database
hibernate.dialect=org.hibernate.dialect.HSQLDialect
# The Hibernate transaction factory to use. See https://confluence.atlassian.com/display/CROWD/Configuring+Crowd
hibernate.transaction.factory_class=org.hibernate.transaction.JDBCTransactionFactory
# The http port you wish to run crowd from, ie: http://localhost:8095/crowd
crowd.tomcat.connector.port=8095
# Tomcat requires a unique port for shutdown
crowd.tomcat.shutdown.port=8020
# Crowd context root
crowd.url=http://localhost:8095/crowd
# Demo context root
demo.url=http://localhost:8095/demo
# OpenID server context root
openidserver.url=http://localhost:8095/openidserver

 

And my nginx.conf

user www-data;
worker_processes 4;
pid /var/run/nginx.pid;



events {
    worker_connections 768;
    # multi_accept on;
}

http {

    ##
    # Basic Settings
    ##
server {
    server_name example.com;
    listen 80;
     location /crowd {
            
        proxy_pass http://localhost:8095;
            proxy_set_header    Host            $host;
            proxy_set_header    X-Real-IP       $remote_addr;
            proxy_set_header    X-Forwarded-for $remote_addr;
            port_in_redirect off;
            proxy_redirect   https://www.example.com/ /;
        #rewrite ^ https://www.example.com/crowd permanent;
    #proxy_set_header X-Forwarded-Host $host;  
        #proxy_set_header X-Forwarded-Server $host;  
        #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        #rewrite ^ https://www.example.com/crowd permanent;

    }
location /jira {  
        proxy_set_header X-Forwarded-Host $host;  
        proxy_set_header X-Forwarded-Server $host;  
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        rewrite ^ https://www.example.com/jira permanent;  
      }
location /confluence {  
        proxy_set_header X-Forwarded-Host $host;  
        proxy_set_header X-Forwarded-Server $host;  
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
        rewrite ^ https://www.example.com/confluence permanent;  
      }  
}
server {
    listen 443 ssl;
    ssl on;
    server_name www.example.com;
    ssl_certificate /etc/nginx/ssl/JiraConfCert.crt;
    ssl_certificate_key /etc/nginx/ssl/JiraConfKey.key;
    
    client_max_body_size 10M;
    location /crowd {
      proxy_set_header X-Forwarded-Host $host;  
      proxy_set_header X-Forwarded-Server $host;  
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
      proxy_pass http://IPADRESS:8095/crowd;  
    }
     location /jira {  
      proxy_set_header X-Forwarded-Host $host;  
      proxy_set_header X-Forwarded-Server $host;  
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
      proxy_pass http://IPADRESS:8080/jira;  
    }
location /confluence {  
      proxy_set_header X-Forwarded-Host $host;  
      proxy_set_header X-Forwarded-Server $host;  
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;  
      proxy_pass http://IPADRESS:8090/confluence;  
    } 
}
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    # server_tokens off;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # Logging Settings
    ##

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    ##
    # Gzip Settings
    ##

    gzip on;
    gzip_disable "msie6";

    # gzip_vary on;
    # gzip_proxied any;
    # gzip_comp_level 6;
    # gzip_buffers 16 8k;
    # gzip_http_version 1.1;
    # gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

    ##
    # nginx-naxsi config
    ##
    # Uncomment it if you installed nginx-naxsi
    ##

    #include /etc/nginx/naxsi_core.rules;

    ##
    # nginx-passenger config
    ##
    # Uncomment it if you installed nginx-passenger
    ##
    
    #passenger_root /usr;
    #passenger_ruby /usr/bin/ruby;

    ##
    # Virtual Host Configs
    ##

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}


#mail {
#    # See sample authentication script at:
#    # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
# 
#    # auth_http localhost/auth.php;
#    # pop3_capabilities "TOP" "USER";
#    # imap_capabilities "IMAP4rev1" "UIDPLUS";
# 
#    server {
#        listen     localhost:110;
#        protocol   pop3;
#        proxy      on;
#    }
# 
#    server {
#        listen     localhost:143;
#        protocol   imap;
#        proxy      on;
#    }
#}

 

Hope someone can help me.

Regards

Jakob

1 answer

It may be a little late,
But I had the same problem and i figured out why it happens and how to fix it.

First, install crowd on the default port, and when you're done, log in and trust the IP your proxy request is coming from.
Yes, even it is from localhost. Go to the Gear Icon > Trusted Proxy Servers

When you do that, follow this configuration to get it working.
https://answers.atlassian.com/questions/236755

Careful to add

secure="true"

to your server.xml if you want the SSO cookie to be working under https (and also flagged as "secure")
Remember that any app that uses crowd as sso needs to have secure flag enabled


Wish you luck! 

Suggest an answer

Log in or Sign up to answer
Atlassian Community Anniversary

Happy Anniversary, Atlassian Community!

This community is celebrating its one-year anniversary and Atlassian co-founder Mike Cannon-Brookes has all the feels.

Read more
Community showcase
Maggie Roney
Published Feb 27, 2018 in Crowd

The Crowd team is looking for feedback on Server & Data Center customers' identity strategies!

Do you own more than one Server or Data Center product? Do you have challenges provisioning users across your Atlassian products? Are you spending a lot of time integrating each Atlassian product wit...

579 views 6 13
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you