Portal for ArcGIS : Can't login due to url wrong port after nginx reverse proxy - arcgis

Question

I'm building an NginX reverse proxy (Ubuntu Server 22.04.1 - NginX 1.22.1) to open an internal Portal for ArcGIS to extranet.
The reverse proxy listen to 8054 and redirects to 2 internal servers using usual TLS 443 port
Everything works fine except a redirection occurring during Portal's login auth.
In Chrome's console, the info of faulty are :
Request URL: https://myserver.mydomain/portal/sharing/rest/portals/self/subscriptionInfo?f=json&token=ARYpO8uD2SRx5tjuhTElBoDT_ojo9YRwvsX7XI51s3GIfvhlMIGpOjRXKN0g8fXFHgfenkIdg-YtF9TtyWvOomu9TyUm2x8mY4SfTlWSX41E9lyP_I0NVWO-xdwGzJqWDU8GJ4oi5sg53mvRH2OMdUA1bwN0fE-jcSEmK4EsxxOHBe6HZbciuGUCh4s8rgDbz7fBlpIdrFBryxe-YbvooLvb1Q8BsVSZFZFYBlclLQk.&callback=dojo_request_script_callbacks.dojo_request_script0
Request Method: GET
Status Code: 404
Remote Address: 10.0.128.36:443
Referrer Policy: strict-origin-when-cross-origin
content-encoding: gzip
content-type: text/html
date: Wed, 25 Jan 2023 09:59:31 GMT
server: nginx
vary: Accept-Encoding
:authority: myserver.mydomain
:method: GET
:path: /portal/sharing/rest/portals/self/subscriptionInfo?f=json&token=ARYpO8uD2SRx5tjuhTElBoDT_ojo9YRwvsX7XI51s3GIfvhlMIGpOjRXKN0g8fXFHgfenkIdg-YtF9TtyWvOomu9TyUm2x8mY4SfTlWSX41E9lyP_I0NVWO-xdwGzJqWDU8GJ4oi5sg53mvRH2OMdUA1bwN0fE-jcSEmK4EsxxOHBe6HZbciuGUCh4s8rgDbz7fBlpIdrFBryxe-YbvooLvb1Q8BsVSZFZFYBlclLQk.&callback=dojo_request_script_callbacks.dojo_request_script0
:scheme: https
accept: */*
accept-encoding: gzip, deflate, br
accept-language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,nl;q=0.6
dnt: 1
sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: script
sec-fetch-mode: no-cors
sec-fetch-site: cross-site
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Usual processed URL returns :
Request URL: https://myserver.mydomain:8054/portal/sharing/rest/oauth2/authorize?client_id=arcgisonline&display=default&response_type=token&state=%7B%22portalUrl%22%3A%22https%3A%2F%2Fmyserver.mydomain%3A8054%2Fportal%22%2C%22useLandingPage%22%3Atrue%7D&expiration=20160&locale=fr-fr&redirect_uri=https%3A%2F%2Fmyserver.mydomain%3A8054%2Fportal%2Fhome%2Faccountswitcher-callback.html&force_login=true&hideCancel=true&showSignupOption=true&canHandleCrossOrgSignIn=true&signuptype=esri
Request Method: GET
Status Code: 200
Remote Address: 10.0.128.36:8054
Referrer Policy: strict-origin-when-cross-origin
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS
access-control-allow-origin: *
access-control-max-age: 1200
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 1416
content-type: text/html;charset=utf-8
date: Wed, 25 Jan 2023 10:51:05 GMT
expires: -1
pragma: no-cache
server: nginx/1.22.1
vary: Origin,Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
:authority: myserver.mydomain:8054
:method: GET
:path: /portal/sharing/rest/oauth2/authorize?client_id=arcgisonline&display=default&response_type=token&state=%7B%22portalUrl%22%3A%22https%3A%2F%2Fmyserver.mydomain%3A8054%2Fportal%22%2C%22useLandingPage%22%3Atrue%7D&expiration=20160&locale=fr-fr&redirect_uri=https%3A%2F%2Fmyserver.mydomain%3A8054%2Fportal%2Fhome%2Faccountswitcher-callback.html&force_login=true&hideCancel=true&showSignupOption=true&canHandleCrossOrgSignIn=true&signuptype=esri
:scheme: https
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
accept-encoding: gzip, deflate, br
accept-language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,nl;q=0.6
cache-control: max-age=0
dnt: 1
referer: https://myserver.mydomain:8054/portal/home/signin.html?useLandingPage=true
sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: same-origin
sec-fetch-user: ?1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
How can I catch, pass, redirect, return, or whatever, the url missing the port 8054 in order to continue auth processing ?
Here are the nginx general and server configs if it may help
Thanks for any help !
nginx.conf
<pre>
user www-data nginx;
worker_processes auto;
error_log /var/log/nginx/main_error.log;
pid /var/run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
worker_rlimit_core 4096;
events {
worker_connections 1024;
multi_accept on;
}
http {
include /etc/nginx/phpconf/php_processes.conf;
include /etc/nginx/mimetypes/mime.types;
client_body_buffer_size 16K;
client_header_buffer_size 1k;
client_max_body_size 12m;
large_client_header_buffers 4 8k;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log off;
access_log /var/log/nginx/main_access.log;
client_body_timeout 30;
client_header_timeout 10;
keepalive_timeout 75s;
send_timeout 60;
keepalive_requests 1000;
proxy_cache_path /var/nginx/cache1 levels=1:2 keys_zone=cache1:10m inactive=5m max_size=1G use_temp_path=off; # (20230113)
proxy_cache_path /var/nginx/cache2 levels=1:2 keys_zone=cache2:10m inactive=5m max_size=1G use_temp_path=off; # (20230113)
# copies data between one FD and other from within the kernel
# faster than read() + write()
sendfile on;
# Limit whole filesize sending at once
sendfile_max_chunk 512k; #(20220905)
# send headers in one piece, it is better than sending them one by one
tcp_nopush on;
tcp_nodelay on;
server_names_hash_bucket_size 64;
types_hash_max_size 2048;
default_type application/octet-stream;
gzip on;
gzip_comp_level 6;
gzip_min_length 256; #(20220605 previous 50)
gzip_proxied any;
gzip_vary on; #(20220605 previous disabled)
gzip_disable “MSIE [1–6]\.(?!.*SV1)”; #(20220605 previous disabled)
gzip_types
application/atom+xml
application/javascript
application/json
application/ld+json
application/manifest+json
application/rss+xml
application/vnd.geo+json
application/vnd.ms-fontobject
application/x-font-ttf
application/x-javascrip # (20200219)
application/x-web-app-manifest+json
application/xhtml+xml
application/xml
font/opentype
image/bmp
image/svg+xml
image/png
image/jpeg
image/x-icon
text/cache-manifest
text/css
text/javascript # (20200219)
text/plain
text/vcard
text/vnd.rim.location.xloc
text/vtt
text/x-component
text/x-cross-domain-policy;
gzip_buffers 16 8k; #(2020110 previous 4k 8k)
# allow the server to close connection on non responding client, this will free up memory
reset_timedout_connection on;
##
# Virtual Host Configs
##
# include /etc/nginx/conf.d/default.conf;
include /etc/nginx/conf.d/port8054.conf;
}
</pre>
port8054.conf
<pre>
server {
## Config base : 18/01/2023
listen 8054 ssl http2;
listen [::]:8054 ssl http2;
## Set TLS 1.2 (ArcGIS compliance)
ssl_certificate /etc/nginx/tls/intra/cacert.pem;
ssl_certificate_key /etc/nginx/tls/intra/cakey-stripped.key;
ssl_trusted_certificate /etc/nginx/tls/intra/rootcacert.pem;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384"; # previous : HIGH:!MD5:!ADH:!DH:!RC4:!RSA:!aNULL
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_buffer_size 1400;
## Set on after debug
ssl_stapling off;
ssl_stapling_verify off;
server_name myserver.mydomain:8054;
keepalive_timeout 75s;
keepalive_requests 1000;
# access_log /var/log/nginx/port8054-access.log;
## Record errors
error_log /var/log/nginx/port8054-error.log debug;
proxy_http_version 1.1;
## Overwrite proxy response headers
proxy_hide_header access-control-allow-methods;
proxy_hide_header access-control-allow-headers;
proxy_hide_header access-control-allow-origin;
add_header access-control-allow-methods "GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS";
add_header access-control-allow-headers "Origin, X-Requested-With, Content-Type, Accept";
add_header access-control-allow-origin "*";
proxy_hide_header x-aspnet-version;
proxy_hide_header x-powered-by;
proxy_set_header "Connection" "";
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Real-IP $remote_addr;
location ^~ /favicon.ico {
}
## PHP files processing
location ~ ^(.+\.php)(.*)$ {
include /etc/nginx/phpconf/fastcgi_params;
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
fastcgi_index index.php;
fastcgi_buffers 8 16k;
fastcgi_buffer_size 32k;
fastcgi_hide_header X-Powered-By;
fastcgi_hide_header X-CF-Powered-By;
## If error 404
try_files $fastcgi_script_name =404;
}
## Set cache for following contents (20201106)
location ~* \.(?:png|jpg|jpeg|gif|ico|svg|otf|ttf|woff|woff2|doc|pdf|css)$ {
include /etc/nginx/proxyparams/proxy_params;
proxy_cache cache1;
proxy_set_header Host $host;
# proxy_pass https://otherserver.mydomain/$1;
# proxy_ssl_verify off;
# add_header X-Cache-Status $upstream_cache_status;
# add_header Pragma "public";
# add_header Cache-Control "max-age=86400, public";
}
location ^~ /portal/ {
proxy_pass https://otherserver.mydomain/portal/;
}
location /10.9.1/{
proxy_pass https://otherserver.mydomain/portal/home/10.9.1/;
}
location /sharing/rest/ {
proxy_intercept_errors on;
proxy_pass https://otherserver.mydomain/portal/sharing/rest/;
}
location ^~ /oauth2/ {
proxy_pass https://otherserver.mydomain/portal/sharing/rest/oauth2/;
}
location /self/ {
proxy_pass https://otherserver.mydomain/portal/sharing/rest/portals/self/;
}
location ^~ /nodejs/ {
proxy_http_version 1.1;
include /etc/nginx/proxyparams/proxy_params;
proxy_pass https://thirdserver.mydomain/;
proxy_buffering on;
proxy_buffer_size 16k;
proxy_busy_buffers_size 24k;
proxy_buffers 64 4k;
client_max_body_size 12m;
}
}
</pre>