I have problems accessing WebSphere Portal which is deployed behind reverse proxy (using Apache). The problem is that while inspecting HTTP requests issued by browser, some requests are targeted at proxy, and some directly at WebSphere Portal.
My Apache configuration:
ProxyPassReverseCookieDomain backend-server proxy-server
ProxyPass / http://backend-server:10039/
ProxyPassReverse / http://backend-server:10039/
The problem is, some generated resources contained absolute URIs targeting at backend-server:10039...
What else should I configure to properly access WebSphere Portal behind reverse proxy?
Because I can answer my own questions, here's what the problem was:
At server-side, portlets and JSPs in WebSphere Portal use request.getServerHost() and request.getServerPort(). To make these methods work behind reverse proxy (which sends Host: header). I had to add:
ProxyPreserveHost On
to apache configuration and:
com.ibm.ws.webcontainer.extractHostHeaderPort = true
trusthostheaderport = true
additional properties to Web Container in IBM Console: WebSphere application servers -> WebSphere_Portal -> Web Container Settings -> Web Container -> Custom properties.
These properties are described here.
I got the same problem few days ago and eventually chose the apache mod_substitute to change these urls with something like this:
Substitute "s|http ://backend-server:10039/|/|i"
Related
My requirement is to hit external HTTPS REST API from application server.i don`t have internet access in application server(JBOSS). so,i forwarded my request to web server(Apache24) and from web server i am calling HTTPS REST API services.
Public Rest URL-: https://publicdomain.com/tracking_number
I made below configuration on Apache server.
ProxyPass /tracking_number https://publicdomain.com/tracking_number
ProxyPassReverse /tracking_number https://publicdomain.com/tracking_number
With above configuration,following URL from application server https://WEBSERVER_IP:PORT/tracking_number, responding 503 proxy error.
Because in web server, internet can be access only through proxy server.
(For example, In IE browsers,if i configure proxy ip and host in LAN settings mean, URL is accessible from browser).
So, i need to configure similar configuration in Apache also. I tried with some configurations with help of http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxyremote. But nothing worked out.
How to configure proxy server(host and ip) for external HTTPS request in Apache.
Apache Version -: 2.4.29
Operating System -: Windows
I'm running in AWS a Ubuntu with a docker server (managed by Portainer) with this two running containers:
1 - NodeRed (Serving my APIs)
2 - Apache (Hosts the site that consumes the APIs from NodeRed above)
I've configured a domain to this server and setted apache to work with SSL. The apache is running ok with my site through HTTPS, but the problem is that the NodeRed (that runs in port 1080) is not configured to run in SSL. This causes a malfunction in my website since that my API endpoints are being running under HTTP and being blocked by the browser due security reasons.
The question is: is there a way to create some kind of "mapping" in apache that receives the request from HTTPS and redirect to the NodeRed in HTTP (the two are running in same server)?
My idea is to create a subdomain like https://api.mysite.com that sends the request for apache and then apache redirects it to my NodeRed. Is that possible?
There is no need to expose the API to the outside world if you don't want to. Since your apache is running correctly and both containers are running on the same host, just use proxy to forward API requests to the API container.
You can achive this by add two lines to your apache config i.e.
ProxyPass /api/ http://127.0.0.1:1080/
ProxyPassReverse /api/ http://127.0.0.1:1080/
There are javaEE applications run on WebSphere server.
The thing I wanna do that to configure a http server that takes the request and redirect to my local websphere server.
For example:
This is live Project testProject.com/Otel..
I wanna reach my local project when I insert local.testProject.com/Otel..
The thing I have done so far I can reach my local apache server when I click local.testProject.com just with adding in host file in windows/system32/drivre/etc directory.
The thing I could not do so far. redirecting this incoming request to my apache server to websphere server.
Could you please help me on these. Dont hasitate to ask further questions.
I would be appreciated if you could give me some ideas with just commenting at least.
Good days..
IBM provides a specialty reverse proxy module for Apache called the WebSphere WebServer Plug-in. Its use is described in detail in the websphere documentation.
In simple configurations, you can just configure any server you already have as a reverse proxy.
Load mod_proxy and mod_proxy_http (varies depending on Apache distribution)
Append to your virtual host:
ProxyPreserveHost ON
ProxyPass /otel http://washostname.example.com/otel
# ProxyPassReverse likely not required in your case.
Of course there are thousands of places to read about setting up Apache as a reverse proxy and there are nearly no WebSphere specifics.
I'm running SonarQube with a reverse proxy. However, I'm also using X.509 authentication between SonarQube and the database for security reasons. I can no longer connect to my PostgreSQL database after upgrading from 5.4 to 5.6 because the certificate isn't being passed.
Is there another way to configure SonarQube to use a local keystore when negotiating an SSL connection to the database?
Is there a plan to add SSL support back?
Is there a plan to add WAR-style deployments back?
I might be stuck at 5.4.
HTTPS is supported by SonarQube using a reverse proxy. Here is the official documentation and the link:
To run the SonarQube server over HTTPS, you must build a standard reverse proxy infrastructure.
The reverse proxy must be configured to set the value "X_FORWARDED_PROTO: https" in each HTTP request header. Without this property, redirection initiated by the SonarQube server will fall back on HTTP.
Using an Apache Proxy
We assume that you've already installed Apache 2 with module mod_proxy, that SonarQube is running and available on http://private_sonar_host:sonar_port/ and that you want to configure a Virtual Host for www.public_sonar.com.
At this point, edit the HTTPd configuration file for the www.public_sonar.com virtual host. Include the following to expose SonarQube via mod_proxy at http://www.public_sonar.com/:
ProxyRequests Off
ProxyPreserveHost On
<VirtualHost *:80>
ServerName www.public_sonar.com
ServerAdmin admin#somecompany.com
ProxyPass / http://private_sonar_host:sonar_port/
ProxyPassReverse / http://www.public_sonar.com/
ErrorLog logs/somecompany/sonar/error.log
CustomLog logs/somecompany/sonar/access.log common
</VirtualHost>
Using Nginx
We assume that you've already installed Nginx, that you are using a Virtual Host for www.somecompany.com and that SonarQube is running and available on http://sonarhost:sonarport/.
At this point, edit the Nginx configuration file. Include the following to expose SonarQube at http://www.somecompany.com/:
# the server directive is nginx's virtual host directive
server {
# port to listen on. Can also be set to an IP:PORT
listen 80;
# sets the domain[s] that this vhost server requests for
server_name www.somecompany.com;
location / {
proxy_pass http://sonarhost:sonarport;
}
}
Using IIS
SonarQube recommends the use of a Reverse Proxy to secure you sonar installation. With the help of IIS and the Url Rewrite module, that's a piece of cake to setup.
What you'll need:
IIS enabled on a machine (doesn't have to be the SonarQube machine, but I'm going to assume you're doing this on the same system)
The Url Rewite extension for IIS (https://www.iis.net/downloads/microsoft/url-rewrite)
The Application Based Routing extension for IIS (https://www.iis.net/downloads/microsoft/application-request-routing)
An SSL certificate (can be self signed or a real one)
First step is to create a IIS website which will act as the reverse proxy.
Unless you're required to do Kerberos authentication, you don't need to configure any form of authentication on your Reverse Proxy. It should forward the challenge from SonarQube if you've configured Active Directory integration there.
If you are using Kerberos or IIS Advanced protection, please look here for guidance on configuring that correctly. (https://blogs.technet.microsoft.com/latam/2015/06/24/kerberos-authentication-and-application-request-routing/)
Configure the binding to use SSL and setup the correct hostnames and the certificate. I'm cheating a little by using the IIS Express Development Certificate installed on my machine:
Next we'll open the URL Rewrite settings to configure reverse proxy:
Click Add Rule to create a new rule:
And pick "Reverse Proxy" from the list of templates:
Enter the destination server URL (can be http://localhost:9000, or even a remote server) and click OK to create the rule:
You're back in the URL Rewrite screen where we'll need to add an extra server variable which we'll send along with the request to the other server in order to tell SonarQube it's actually behind a Reverse Proxy that's doing the SSL offloading for it:
Click "Add..." to create the server variable:
Add the server variable "X_FORWARDED_PROTO" to allow the Rewrite Module to manipulate this header:
You should now have the variable listed in the Variable list. Click "Go back to Rules" to move back to the rules list:
Edit the URL Rewrite rule you've just created:
Expand the Server variables section of the rule definition:
Add the "X_FORWARDED_PROTO" header you've allowed in the previous step and give it the value "https":
Apply the changes:
And now you should be able to access SonarQube over SSL. You may want to configure the original SonarQube instance to only accept traffic from your reverse proxy or only accept traffic from localhost through the Windows Firewall.
Copied from:
USING IIS
Server setup documentation
Answer to point 2 : The only way to deal with HTTPS on SonarQube is to use a proxy.
Have a look at the documentation for more information.
Answer to point 3 : No, there's no plan to get back to WAR.
Tomcat in our application is considered back-and side and additionaly we have apache that fronting tomcat server as a reverse proxy and redirect requests to appropriate tomcat instance.
Now we need to set up HTTPS connection between apache proxy and tomcat for specific urls(Login, etc..). Tomcat documentation says that it's possible to achieve this with additional <Connector> within server.xml config.
In order to set up https over login page existing configuration with AJP protocol was replaced with the following:
ProxyPass /app/login/ https://127.0.0.1:6666/app/login/
All other urls specified like below:
ProxyPass /app/anyotherurl/ ajp://127.0.0.1:5555/app/anyotherurl/
With configuration below we expect that secure data (login/password) for login page will be encrypted and all other page will remain unchanged.
After the login apache should use normal ajp protocol because there is no sensetive information any more to protect. But it's not what actually happen in our case because for some reason apache is redirecting us to host specified in ProxyPass, namely to localhost.
This could happen due to the fact that our application while executing login logic on tomcat has two consecutive redirects.
We've tried to set ProxyPreserveHost on within virtual host to fix situation mentioned above, but we are not sure whether it is secure option and this one won't break another pages as well as we are not sure how it will work if tomcat will be located on other machine.
It would be good to know any other solution how such stuff can be applied internally for specific pages.