Crowd behind Nginx proxy

[Nicolas_Grussenmeyer]

Hi,

We are currently evaluating Crowd because we want SSO login between all Atlassian applications in our domain (we plan to buy Confluence, JIRA, Bamboo, Stash and Crucible).
The install of Crowd 2.7.0 went fine on a Windows Server 2008 R2, following the guides in Confluence.

My setup is as follows :

• A Nginx edge server, IP 192.168.42.11
• The server with Crowd, IP 192.168.42.18

I want to connect to Crowd using this URL : https://sso.example.com/crowd
The idea is that Nginx will handle the SSL part and reverse proxy the request to Crowd. I followed this guide :https://confluence.atlassian.com/display/CROWDKB/How+to+use+NGINX+to+proxy+requests+for+Crowd
I entered the URL https://sso.example.com/crowd as base URL during setup using the wizard.
I changed the Tomcat 7 server.xml to be as follows :

<Connector 	acceptCount="100"
           	connectionTimeout="20000"
		   	disableUploadTimeout="true"
		   	enableLookups="false"
			maxHttpHeaderSize="8192"
			proxyName="sso.example.com"
			proxyPort="443"
			scheme="https"
			maxThreads="150"
			minSpareThreads="25"
			port="8095"
			redirectPort="8443"
			useBodyEncodingForURI="true"
			URIEncoding="UTF-8" />

        <Engine defaultHost="localhost" name="Catalina">
            <Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/>
        </Engine>

        <!-- To connect to an external web server (typically Apache) -->
        <!-- Define an AJP 1.3 Connector on port 8009 -->

            <Connector 	port="8009" 
						enableLookups="false"
						redirectPort="8443"
						protocol="AJP/1.3" />

I am able to access Crowd, to login, and go to the Administration section just fine. My problem is that I can't activate the SSO feature as Crowd complains that "The supplied domain is invalid.". I entered ".example.com." in the SSO domain field. Moreover, it seems that Crowd doesn't detect that it is accessed by SSL as the Secure SSO Cookie checkbox is grayed out.

Here is my crowd.properties file :

#Thu Nov 21 22:06:34 CET 2013
session.lastvalidation=session.lastvalidation
application.password=6dxPjMH1
session.isauthenticated=session.isauthenticated
application.name=crowd
crowd.server.url=https\://sso.example.com/crowd/services/
session.validationinterval=0
session.tokenkey=session.tokenkey
application.login.url=https\://sso.example.com/crowd

and my Nginx configuration file :

server {
    listen 443;
    server_name sso.example.com;

    location / {
            proxy_pass http://192.168.42.18:8095/;
            proxy_set_header    Host            $host;
            proxy_set_header    X-Real-IP       $remote_addr;
            proxy_set_header    X-Forwarded-for $remote_addr;
            port_in_redirect off;
            proxy_redirect   https://sso.example.com/ /;     
    }
}

Can you please provide some help here, as the SSO feature is pretty much the most important reason why we want to buy Crowd.

Thanks,
Nicolas Grussenmeyer

[Caspar Krieger · Accepted solution]

That message appears when the entered domain is both:

• Not equal to the host as tomcat sees it
• Not a suffix of the host as tomcat sees it

Or putting it a bit more simply: if Crowd sees that you're accessing it from "sub.foobar.com", then

• sub.foobar.com is a valid domain to enter there
• foobar.com is also valid
• .foobar.com (i.e. with a leading period) is also valid
• foobar.com. (i.e. with a trailing period) is NOT valid
• .foobar.com. (i.e. with both a leading and trailing period) is NOT valid

The logic is basically around to prevent people from being able to lock themselves out of Crowd.

Those last two cases might seem like they should be valid, but as of Crowd 2.5 (specifically CWD-1945), Crowd is following the spec https://tools.ietf.org/html/rfc6265#section-4.1.2.3.

So try entering in a domain of "example.com" or ".example.com" (you can also leave it blank, in which case Crowd will try to auto-detect the domain).

Moreover, it seems that Crowd doesn't detect that it is accessed by SSL as the Secure SSO Cookie checkbox is grayed out.

I wouldn't worry about this, because this is what I'd expect when your reverse proxy is handling SSL; Crowd enables that checkbox based on whether the connection Crowd is made via SSL, and your reverse proxy is proxy passing to Crowd without SSL.

[Nicolas_Grussenmeyer]

Thank you, using .example.com solved the problem.

It was that simple :-)

[David Yu]

To ungrey the SSO checkbox, you need to have this in your nginx config (assuming SSL terminated at nginx)

proxy_set_header X-Forwarded-Proto $scheme;

[Raffi Enficiaud]

I have the following configuration

For NGinx

location /crowd {
  proxy_pass          http://localhost:8095/crowd;
  proxy_set_header    Host            $host;
  proxy_set_header    X-Real-IP       $remote_addr;
  proxy_set_header    X-Forwarded-for $remote_addr;
  port_in_redirect    off;
  proxy_redirect      $scheme://$server_name/crowd /crowd;
}

and for server.xml

<Connector port="8095" maxHttpHeaderSize="8192"
  maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
  enableLookups="false" acceptCount="100"
  connectionTimeout="20000" disableUploadTimeout="true"
  proxyName="my-proxy" 
  proxyPort="443" secure="true" scheme="https" redirectPort="8443" 
  useBodyEncodingForURI="true" URIEncoding="UTF-8"
/>

It seems to work like a charm for all applications so far, and the SSO button is not greyed anymore. Am I missing something?