Crowd + Nginx + SSL - Not Working

Question

Hi everybody Im using JIRA and Confluence. Im trying to set it up with Crowd with the url www.examle.com/crowd I have a Ubuntu Server and JIRA and Confluence is working over SSL but cant get Crowd to work. Im getting different errors when trying to get it to work. My server.xml: crowd-init.properties ############### ## ## ## UNIX ## ## ## ############### ## On Unix-based operating systems, uncomment the following ## line and set crowd.home to a directory Crowd should use to ## store its configuration. crowd.home=/var/crowd-home build.properties # Modify the attributes of this file to quickly adjust the deployment values of Crowd. # The Hibernate database dialect to use. See https://confluence.atlassian.com/display/CROWD/Connecting+Crowd+to+a+Database hibernate.dialect=org.hibernate.dialect.HSQLDialect # The Hibernate transaction factory to use. See https://confluence.atlassian.com/display/CROWD/Configuring+Crowd hibernate.transaction.factory_class=org.hibernate.transaction.JDBCTransactionFactory # The http port you wish to run crowd from, ie: http://localhost:8095/crowd crowd.tomcat.connector.port=8095 # Tomcat requires a unique port for shutdown crowd.tomcat.shutdown.port=8020 # Crowd context root crowd.url=http://localhost:8095/crowd # Demo context root demo.url=http://localhost:8095/demo # OpenID server context root openidserver.url=http://localhost:8095/openidserver And my nginx.conf user www-data; worker_processes 4; pid /var/run/nginx.pid; events { worker_connections 768; # multi_accept on; } http { ## # Basic Settings ## server { server_name example.com; listen 80; location /crowd { proxy_pass http://localhost:8095; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-for $remote_addr; port_in_redirect off; proxy_redirect https://www.example.com/ /; #rewrite ^ https://www.example.com/crowd permanent; #proxy_set_header X-Forwarded-Host $host; #proxy_set_header X-Forwarded-Server $host; #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #rewrite ^ https://www.example.com/crowd permanent; } location /jira { proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; rewrite ^ https://www.example.com/jira permanent; } location /confluence { proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; rewrite ^ https://www.example.com/confluence permanent; } } server { listen 443 ssl; ssl on; server_name www.example.com; ssl_certificate /etc/nginx/ssl/JiraConfCert.crt; ssl_certificate_key /etc/nginx/ssl/JiraConfKey.key; client_max_body_size 10M; location /crowd { proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://IPADRESS:8095/crowd; } location /jira { proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://IPADRESS:8080/jira; } location /confluence { proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_pass http://IPADRESS:8090/confluence; } } sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 65; types_hash_max_size 2048; # server_tokens off; # server_names_hash_bucket_size 64; # server_name_in_redirect off; include /etc/nginx/mime.types; default_type application/octet-stream; ## # Logging Settings ## access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; ## # Gzip Settings ## gzip on; gzip_disable "msie6"; # gzip_vary on; # gzip_proxied any; # gzip_comp_level 6; # gzip_buffers 16 8k; # gzip_http_version 1.1; # gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript; ## # nginx-naxsi config ## # Uncomment it if you installed nginx-naxsi ## #include /etc/nginx/naxsi_core.rules; ## # nginx-passenger config ## # Uncomment it if you installed nginx-passenger ## #passenger_root /usr; #passenger_ruby /usr/bin/ruby; ## # Virtual Host Configs ## include /etc/nginx/conf.d/*.conf; include /etc/nginx/sites-enabled/*; } #mail { # # See sample authentication script at: # # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript # # # auth_http localhost/auth.php; # # pop3_capabilities "TOP" "USER"; # # imap_capabilities "IMAP4rev1" "UIDPLUS"; # # server { # listen localhost:110; # protocol pop3; # proxy on; # } # # server { # listen localhost:143; # protocol imap; # proxy on; # } #} Hope someone can help me. Regards Jakob

Gabriele Turelli · Answer

It may be a little late,
But I had the same problem and i figured out why it happens and how to fix it.

First, install crowd on the default port, and when you're done, log in and trust the IP your proxy request is coming from.
Yes, even it is from localhost. Go to the Gear Icon > Trusted Proxy Servers

When you do that, follow this configuration to get it working.
https://answers.atlassian.com/questions/236755

Careful to add

secure="true"

to your server.xml if you want the SSO cookie to be working under https (and also flagged as "secure")
Remember that any app that uses crowd as sso needs to have secure flag enabled

Wish you luck!