<div dir="ltr">wiki edited.<br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><p><span style="font-family:Arial,sans-serif;font-size:10pt">--</span></p><p><span style="font-family:Arial,sans-serif;font-size:10pt">s pozdravem</span></p><div style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:13px"><p><strong>Petr Gašparík</strong><br><span style="font-size:11px;color:rgb(128,128,128)">solution architect</span></p></div><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px">gsm: [+420] 603 523 860<br>e‑mail: <a href="mailto:petr.gasparik@ami.cz" target="_blank">petr.gasparik@ami.cz</a></p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px"><strong>AMI Praha a.s.</strong><br>Pláničkova 11, 162 00 Praha 6</p><p style="color:rgb(0,0,0);font-family:Arial,sans-serif;font-size:11px">tel.: [+420] 274 783 239 | web: <a href="https://www.ami.cz" target="_blank">www.ami.cz</a></p><p style="color:rgb(0,0,0);font-family:Verdana,Arial,Helvetica,sans-serif;font-size:10px;margin-top:20px"><img src="http://www.ami.cz/images/podpis/ami_logo.gif" alt="AMI Praha a.s." style="border:0px"></p><p style="font-family:Arial,sans-serif;font-size:11px;color:rgb(170,170,170)">Textem tohoto e‑mailu podepisující neslibuje uzavřít ani neuzavírá za společnost AMI Praha a.s.<br>jakoukoliv smlouvu. Každá smlouva, pokud bude uzavřena, musí mít výhradně písemnou formu.<br><span style="font-size:6px"> </span><br>Tento e‑mail je určen výhradně pro potřeby jeho adresáta/ů a může obsahovat důvěrné nebo osobní<br>informace. Nejste‑li zamýšleným příjemcem, je zakázáno jakékoliv zveřejňování, zprostředkování<br>nebo jiné použití těchto informací. Pokud jste obdrželi e‑mail neoprávněně, informujte o tom prosím<br>odesílatele a vymažte neprodleně všechny kopie tohoto e‑mailu včetně všech jeho příloh. Nakládáním<br>s neoprávněně získanými informacemi se vystavujete riziku právního postihu.</p></div></div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">po 26. 8. 2019 v 14:09 odesílatel Ramón Cahenzli <<a href="mailto:ramon.cahenzli@zhdk.ch">ramon.cahenzli@zhdk.ch</a>> napsal:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi everyone,<br>
<br>
It seems I spoke too soon when I said reverse proxying midPoint now<br>
works for us. I've talked about this earlier and Stacy Brock had a<br>
solution for Apache that seemed to work:<br>
<br>
RewriteEngine on<br>
RewriteRule ^/$ /midpoint/ [R,L]<br>
RewriteRule ^/midpoint$ /midpoint/ [R,L]<br>
<br>
ProxyPreserveHost on<br>
RequestHeader set X-Forwarded-Proto https<br>
RequestHeader set X-Forwarded-Port 443<br>
ProxyPass "/midpoint/" "<a href="http://127.0.0.1:8080/midpoint/" rel="noreferrer" target="_blank">http://127.0.0.1:8080/midpoint/</a>"<br>
ProxyPassReverse "/midpoint/" "<a href="http://127.0.0.1:8080/midpoint/" rel="noreferrer" target="_blank">http://127.0.0.1:8080/midpoint/</a>"<br>
# midPoint can be slow to respond, so we set the timeout to 10 minutes<br>
ProxyTimeout 600<br>
<br>
But midPoint itself still generates redirects to HTTP on port 80<br>
instead of using the information from X-Forwarded-Proto and<br>
X-Forwarded-Port as instructed.<br>
<br>
In application.yml we configure:<br>
<br>
server.address: 127.0.0.1<br>
server.port: 8080<br>
server.session.timeout: 60<br>
server.use-forward-headers: true<br>
server.tomcat.internal-proxies: 127.0.0.1<br>
server.tomcat.protocol-header: X-Forwarded-Proto<br>
server.tomcat.protocol-header-https-value: https<br>
server.tomcat.port-header: X-Forwarded-Port<br>
<br>
Yet we see midPoint redirecting to http://.../dashboard and<br>
http://.../login on, as on the screenshot. When port 80 is closed,<br>
users can't log in. midPoint seems to ignore<br>
server.tomcat.protocol-header and<br>
server.tomcat.protocol-header-https-value.<br>
<br>
The config information is from here:<br>
<br>
<a href="https://wiki.evolveum.com/display/midPoint/Using+MidPoint+with+embedded+Tomcat" rel="noreferrer" target="_blank">https://wiki.evolveum.com/display/midPoint/Using+MidPoint+with+embedded+Tomcat</a><br>
<br>
Incidentally, there is an error in that example (the block on line<br>
78-87 should be indented under server.tomcat.accesslog) but I can<br>
create a Jira ticket for that.<br>
<br>
Any ideas what we could do to address the issue? We want midPoint to<br>
know that it needs to stay on HTTPS and not generate redirects to :80.<br>
<br>
Cheers,<br>
<br>
-- <br>
—<br>
—<br>
Zürcher Hochschule der Künste<br>
Zurich University of the Arts<br>
—<br>
Ramón Cahenzli, MSc.<br>
IT Architect<br>
—<br>
Pfingstweidstrasse 96, Postfach, 8031 Zürich<br>
Tel. +41 43 446 31 63, Fax +41 43 446 45 21<br>
<a href="mailto:ramon.cahenzli@zhdk.ch" target="_blank">ramon.cahenzli@zhdk.ch</a><br>
—<br>
<a href="http://www.zhdk.ch" rel="noreferrer" target="_blank">http://www.zhdk.ch</a><br>
<a href="http://itz.zhdk.ch" rel="noreferrer" target="_blank">http://itz.zhdk.ch</a><br>
_______________________________________________<br>
midPoint mailing list<br>
<a href="mailto:midPoint@lists.evolveum.com" target="_blank">midPoint@lists.evolveum.com</a><br>
<a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
</blockquote></div>