prantikk
commented
1 year ago Hi Ian, Did you find a resolution to this redirect issue?
Open ianhinder opened 2 years ago
prantikk
commented
1 year ago Hi Ian, Did you find a resolution to this redirect issue?
jmzumg
commented
1 year ago Hey, I was experiencing the same problem (using nginx rather than traefik, but I think it still applies)
I solved it by making the following changes:
In my nginx site config, I set the X-Forwarded-Proto header like this: proxy_set_header X-Forwarded-Proto $scheme;
(I am not sure how to configure this header in traefik, but it should be possible)
In my tomcat server.xml, I modified the Host section like this:
<Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true">
<!-- blah blah blah -->
<Valve className="org.apache.catalina.valves.RemoteIpValve" remoteIpHeader="X-Forwarded-For" protocolHeader="X-Forwarded-Proto" protocolHeaderHttpsValue="https"/>
</Host>This solved the issue for me.
References:
ianhinder
commented
1 year ago Apologies; I was able to fix it a while back. Here was my solution:
commit 20b167cb0ada9d22574e4d5bceade485c2eb3481
Author: Ian Hinder <XXX>
Date: Tue Mar 15 22:57:02 2022 +0000
Add proxy header configuration to tomcat server.xml during image build
This allows xnat to work correctly behind traefik with TLS
diff --git a/xnat/Dockerfile b/xnat/Dockerfile
index 8021783..b7b2704 100644
--- a/xnat/Dockerfile
+++ b/xnat/Dockerfile
@@ -31,7 +31,7 @@ ADD wait-for-postgres.sh /usr/local/bin/wait-for-postgres.sh
ADD ${XNAT_PATH} /webapps
RUN apt-get update && \
- apt-get --yes install postgresql-client wget && \
+ apt-get --yes install postgresql-client wget patch && \
apt-get --yes --auto-remove upgrade && \
rm -rf ${CATALINA_HOME}/webapps/* && \
mkdir -p \
@@ -50,6 +50,10 @@ RUN apt-get update && \
rm /usr/local/bin/make-xnat-config.sh && \
apt-get clean
+ADD RemoteIpValve.patch /tmp/RemoteIpValve.patch
+RUN patch /usr/local/tomcat/conf/server.xml /tmp/RemoteIpValve.patch
+RUN rm -f /tmp/RemoteIpValve.patch
+
EXPOSE 8000
EXPOSE 8080
diff --git a/xnat/RemoteIpValve.patch b/xnat/RemoteIpValve.patch
new file mode 100644
index 0000000..ffdd278
--- /dev/null
+++ b/xnat/RemoteIpValve.patch
@@ -0,0 +1,16 @@
+--- server.xml 2022-02-21 21:01:10.000000000 +0000
++++ server.xml 2022-03-15 22:41:45.228952764 +0000
+@@ -137,6 +137,13 @@
+ <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+ -->
+
++ <!-- Ensure that original protocol and port information is
++ available when behind a reverse proxy -->
++ <Valve className="org.apache.catalina.valves.RemoteIpValve"
++ protocolHeader="x-forwarded-proto"
++ portHeader="x-forwarded-port"
++ />
++
+ <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+ via a brute-force attack -->
+ <Realm className="org.apache.catalina.realm.LockOutRealm">So similar to @jmzumg's solution, though not quite the same.
Describe the bug Login redirect from / to /app/template/Login.vm changes from https to http.
To Reproduce Steps to reproduce the behavior:
Check http on port 80 works:
Note the Location line, which gives a correct redirection.
Now check https on port 443:
Note the location: line, which has redirected to http from https. When used in a browser, you can replace the http after redirection with an https, and the rest of XNAT works fine over https, until you get another redirection, at which point it uses http and you need to change it manually to https. Note that it is redirecting to the correct host and path; it's just the scheme (https vs http) that is wrong.
This is all independent of the site URL configured in XNAT; even if you set that to the correct https URL, it breaks in the same way.
Expected behavior I expect https requests to be redirected to https, not to http.
Screenshots n/a
Docker server environment (please complete the following information):
Configuration:
Additional context
This is a cut down example which makes use of the internal self-signed traefik certificate, and I use --insecure in curl to handle this. I have set up traefik's LetsEncrypt support in this docker-compose file successfully, and everything works apart from this redirect. Once the redirect works, I can add my config to #1 for other people to use.
I don't know if this is caused by XNAT itself, or if the traefik reverse proxying is not working, or if traefik needs to be configured differently to work with XNAT. But it would be great to get this working, as it provides a very simple way to set up https access to XNAT with docker-compose.