Open shashanknimje opened 1 year ago
pitastrudl
commented
1 year ago You are saying it's on the same machine, is the exposure of drawios 80 and 443 port conflicting with gitlabs http/https ports? Is there an nginx sitting in front of these services?
shashanknimje
commented
1 year ago Hi @pitastrudl, thank you for getting back to me. There’s a nginx proxy (docker container) forwarding the requests on 80 and 443 to the rest of the containers. In fact, the drawio docker container is able to authenticate with google drive with the help of the nginx prroxy docker container.
wolkenschieber
commented
5 months ago I was having the same issue, but hours of googling did the trick.
GitLab on http://edoras/gitlab is configured for the Draw.io application:
Draw.io is running on http://angband:8080/
services:
drawio:
image: jgraph/drawio
container_name: drawio
restart: unless-stopped
ports:
- 8080:8080
environment:
- DRAWIO_SERVER_URL=http://angband:8080/
- DRAWIO_GITLAB_URL=http://edoras/gitlab
- DRAWIO_GITLAB_ID=id-from-screenshot
- DRAWIO_GITLAB_SECRET=secret
- LETS_ENCRYPT_ENABLED=falseThis allowed me to authorize to GitLab: http://edoras/gitlab/oauth/authorize returned status code 200,
but Draw.io didn't accept the grant:
drawio | SEVERE [http-nio-8080-exec-3] com.mxgraph.online.AbsAuth.contactOAuthServer AUTH-SERVLET: [http://edoras/gitlab/oauth/token] ERROR: Server returned HTTP response code: 400 for URL: http://edoras/gitlab/oauth/token -> {"error":"invalid_grant","error_description":"The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client."}
drawio | java.io.IOException: Server returned HTTP response code: 400 for URL: http://edoras/gitlab/oauth/token
drawio | at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
drawio | at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
drawio | at com.mxgraph.online.AbsAuth.contactOAuthServer(Unknown Source)
drawio | at com.mxgraph.online.AbsAuth.doGetAbst(Unknown Source)
drawio | at com.mxgraph.online.GitlabAuthServlet.doGet(Unknown Source)Issue #91, respective issuecomment-1550527468, pointed to DRAWIO_USE_HTTP=1, which accepted the grant, but was blocked by CORS:
Refused to connect to 'http://edoras/gitlab/api/v4/user' because it violates the following Content Security Policy directive: "connect-src 'self' https://*.dropboxapi.com https://api.trello.com https://api.github.com https://raw.githubusercontent.com https://*.googleapis.com https://*.googleusercontent.com https://graph.microsoft.com https://*.1drv.com https://*.sharepoint.com https://gitlab.com https://*.google.com https://fonts.gstatic.com https://fonts.googleapis.com".Issue #108, respective issuecomment-1483316381, pointed out to add the GitLab-Host to DRAWIO_CSP_HEADER.
So working for me is this compose file:
services:
drawio:
image: jgraph/drawio
container_name: drawio
restart: unless-stopped
ports:
- 8080:8080
environment:
- DRAWIO_SERVER_URL=http://angband:8080/
- DRAWIO_GITLAB_URL=http://edoras/gitlab
- DRAWIO_GITLAB_ID=id-from-screenshot
- DRAWIO_GITLAB_SECRET=secret
- DRAWIO_CSP_HEADER=default-src \'self\'; script-src \'self\' https://storage.googleapis.com https://apis.google.com https://docs.google.com https://code.jquery.com \'unsafe-inline\'; connect-src \'self\' http://edoras https://*.dropboxapi.com https://api.trello.com https://api.github.com https://raw.githubusercontent.com https://*.googleapis.com https://*.googleusercontent.com https://graph.microsoft.com https://*.1drv.com https://*.sharepoint.com https://gitlab.com https://*.google.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src * data:; media-src * data:; font-src * about:; style-src \'self\' \'unsafe-inline\' https://fonts.googleapis.com; frame-src \'self\' https://*.google.com;
- DRAWIO_USE_HTTP=1
- LETS_ENCRYPT_ENABLED=false
Hi, Thank you very much to the jgraph team and all the contributors for all your hard work in creating this amazing tool! :)
Apologies for the verbose post. I thought it would be helpful to have all the info in one place.
I am receiving HTTP Error 500 connection refused upon trying to authorize docker drawio 20.2.8 with docker gitlab-ce 15.3, both running on the same VM using the same docker network.
When I try to access https://drawio.domain.com/gitlab url directly, I get HTTP Error 400.
Both the docker containers, i.e, drawio and gitlab-ce have ssl certs issued by Let's Encrypt. And both of these certs have been added to the keystore inside docker drawio container inside the bundle.pfx keystore file inside the tomcat folder.
server.xml has been modified to allow communication over port 80 and 443 instead of 8080 and 8443.
Also, the same docker container is able to authenticate / authorize successfully with google drive, but not self hosted docker gitlab-ce.
The callback url configured on the docker gitlab-ce self hosted instance is set to https://drawio.domain.com/gitlab
Although both the docker containers, drawio and gitlab-ce are on the same VM, NAT and Firewall / Network security settings have also been configured so these instances can communicate with each other over the internet.
Any help in resolving this issue would be super appreciated. Thank you!
docker-compose.yml
server.xml
docker-compose up output
catalina.log
localhost_access_log