OAuth 2.0 Thingsboard CE redirect with HTTP url (and not HTTPS)

[benoit-rolandeau-act]

As asked in this issue, I create a particular one: https://github.com/thingsboard/thingsboard/issues/13103 ; but for me, it seems to be the same "problem".

Describe the bug

We have set up a OAuth 2.0 client for Google on our Thingsboard Community server.

We followed both recommended documentation:

• https://thingsboard.io/docs/user-guide/oauth-2-support/#mapping-of-the-external-user-into-thingsboard-internal-user-structure
• https://developers.google.com/identity/openid-connect/openid-connect

We have created the client in GCP and set the redirected uri, as you can see here:

But when we try to connect with a Google account the following error raises:

If I add the same address but with http and not https as you can see here:

Everything works well.

Therefore, for me it seems that Thingsboard asks to redirect to a HTTP url and not a HTTPS.

Good to know:

• the TLS is managed by a HAProxy (therefore Thingsboard doesn't manage TLS by itself), but we set up a HTTPS url in the General Settings (I don't know if it's linked, or not)

Your Server Environment

• own setup
  • Deployment: microservices
  • Deployment type: docker-compose
  • 3.9.1
  • Community
  • Debian 12

Your Client Environment Desktop (please complete the following information):

• OS: Windows 11
• Browser Mozilla Firefox
• Version 137.0.1 (64 bits)

[benoit-rolandeau-act]

If it's possible, can you explain how you get the scheme information transferred to Google? (how do you choose between http and https)

[benoit-rolandeau-act]

Ok, we find the problem, it was on our side.

We didn't configure correctly our HAProxy. Those elements were missing in haproxy.cfg file, within the "frontend" or "listen" section:

http-request set-header X-Forwarded-Proto https
http-request set-header X-Forwarded-Port 443

(Of course, you have to adapt the port with the HTTPS port you use)

[ZoeOrgatex]

Oh that sounds great, thanks a lot @benoit-rolandeau-act I didn't test it but sound logic, I will adapt this configuration in our cluster and I will come back to you