Having issues with crowd + nginx + SSL

[Doug Rowe]

Here's my current nginx config: (domain renamed to protect the innocent)

server {
listen 80;
server_name crowd.*;
access_log off;

client_max_body_size 10M;
return 301 https://crowd.example.com$request_uri;<br< a="">> }

server {
listen 443 ssl;
server_name crowd.example.com;
access_log off;

client_max_body_size 10M;

ssl_certificate /etc/nginx/ssl/crowd.example.com.crt;
ssl_certificate_key /etc/nginx/ssl/crowd.example.com.key;

location / {
proxy_pass http://localhost:8095/;<br< a="">> proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
port_in_redirect off;
proxy_redirect https://crowd.example.com//;
}
}

Here's my server.xml

<?xml version="1.0" encoding="UTF-8"?>
<Server port="8020" shutdown="SHUTDOWN">

<Service name="Catalina">

<Connector
acceptCount="100"
connectionTimeout="20000"
disableUploadTimeout="true"
enableLookups="false"
maxHttpHeaderSize="8192"
maxThreads="150"
minSpareThreads="25"
port="8095"
redirectPort="8443"
useBodyEncodingForURI="true"
URIEncoding="UTF-8"

proxyName="crowd.example.com"
proxyPort="443"
scheme="https"
secure="true"/>

<Engine defaultHost="localhost" name="Catalina">
<Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/>
</Engine>

<!-- To connect to an external web server (typically Apache) -->
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />
</Service>
<!-- Security listener. Documentation at /docs/config/listeners.html
<Listener className="org.apache.catalina.security.SecurityListener" />
-->
<!--APR library loader. Documentation at /docs/apr.html -->
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
<!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
<Listener className="org.apache.catalina.core.JasperListener" />
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />

</Server>

Here's my crowd.properties:

#Tue Aug 05 15:44:15 EDT 2014
session.lastvalidation=session.lastvalidation
session.tokenkey=session.tokenkey
crowd.server.url=http\://localhost\:8095/crowd/services/
application.name=crowd
http.timeout=30000
session.isauthenticated=session.isauthenticated
application.login.url=http\://localhost\:8095/crowd
session.validationinterval=0
application.password=fslLXYfj9DehGTmGjLqZbX

Now, I can surf to https://crowd.example.comand to https://crowd.example.com/crowd, but after I attempt to log in, I get into a redirect cycle for some reason.

[Mallmann]

Hello Doug,

After analyzing your configurations, I found some wrong settings which I guess might be causing the behaviour you're facing.

Follow bellow your configurations with some modifications:

1. Replace your current server block which is listening to the port 443 with the following code into your nginx.conf:

server {

	listen 443;

	server_name crowd.example.com;

	access_log off;

	client_max_body_size 10M;

	ssl on;

	ssl_certificate /etc/nginx/ssl/crowd.example.com.crt;

	ssl_certificate_key /etc/nginx/ssl/crowd.example.com.key;

	location / { 

		proxy_pass http://localhost:8095;

		proxy_set_header Host $host;

		proxy_set_header X-Real-IP $remote_addr;

		proxy_set_header X-Forwarded-For $remote_addr;

		port_in_redirect off; 

		proxy_redirect https://crowd.example.com/ /; 

	}

}

2. Update your current crowd.properties file with the following:

#Tue Aug 05 15:44:15 EDT 2014

session.lastvalidation=session.lastvalidation

session.tokenkey=session.tokenkey

crowd.server.url=https\://crowd.example.com/crowd/services/

application.name=crowd

http.timeout=30000

session.isauthenticated=session.isauthenticated

application.login.url=https\://crowd.example.com

session.validationinterval=0

application.password=fslLXYfj9DehGTmGjLqZbX

Remember to restart both, NGINX and Crowd, after these changes.

Please, let me know if it helped you.

Best regards,

Eduardo Mallmann

Atlassian Support