search

hlavki / g-suite-identity-sync

G Suite to LDAP identity synchronizer
Apache License 2.0
128 stars 29 forks source link

X-Forwarded-Proto header is not considered in OAuth2 redirect URI #27

Closed hlavki closed 5 years ago

hlavki commented 5 years ago

When I am using apache2 as proxy server with configuration:

<VirtualHost *:443>
  ServerName accounts.example.com

  SSLEngine On
  SSLCertificateFile /usr/local/apache2/conf/ssl/accounts.example.com.cer
  SSLCertificateKeyFile /usr/local/apache2/conf/ssl/accounts.example.com.key
  SSLCertificateChainFile /usr/local/apache2/conf/ssl/accounts.example.com-fullchain.cer

  ProxyPreserveHost On
  RewriteEngine     On

  RequestHeader set X-Forwarded-Proto "https"

  ProxyPassMatch ^/.well-known/acme-challenge !

  ProxyPassMatch ^/cxf/(.*) http://identity:8181/cxf/$1
  ProxyPassMatch ^/(.*) http://identity:8181/$1
  ProxyPassReverse / http://identity:8181
</VirtualHost>

then OAuth2 redirectUri uses http instead of https scheme.