ubccr / mokey

FreeIPA self-service account management portal
BSD 3-Clause "New" or "Revised" License
191 stars 46 forks source link

Proxy error #109

Closed pqvindesland closed 1 year ago

pqvindesland commented 2 years ago

Hi

I got what seems to be a timeout related issue, if I enable require_verify_email: true then it times out when a user tries to create a account, the account is created but the user get's the error:

Proxy Error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request POST /auth/forgotpw.

Reason: Error reading from remote server

If i disable require_verify_email then the users doesn't get any errors.

The proxy configuration is: <Proxy *> Require all granted ProxyPass / http://127.0.0.1:8080/ retry=1 acquire=3000 timeout=60000 Keepalive=On ProxyPassReverse / http://127.0.0.1:8080/

Do you know of any workaround for this?

Regards Per

aebruno commented 2 years ago

@pqvindesland Not sure how this would be related to the require_verify_email setting. This seems like it's strictly an apache proxy issue? We don't use apache but FWIW, here's what we use for our nginx configs:

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://localhost:8080;
    }

Hope that helps.

varesa commented 2 years ago

We were getting 502 bad gateway errors, with or without require_verify_email. With nginx this manifested as such in error.log:

upstream prematurely closed connection while reading response header from upstream, client: <ip>, server: <hostname>, request: "POST /<prefix>/auth/signup HTTP/2.0"

It turns out that there is a five second timeout defined in https://github.com/ubccr/mokey/blob/master/server/server.go#L146-L151. In our case it was just FreeIPA API taking ~5 seconds to handle the requests, but I could see the issue being also caused by a slow email server, especially if you are already close to the limit with FreeIPA itself

aebruno commented 2 years ago

@varesa Thanks for reporting this. In the next upcoming version of mokey this will be configurable. Hoping to have the next version out soon.

pqvindesland commented 2 years ago

I'm a bit late to the party but since I am still seeing the issue regard less of if I am using Apache or Nginx then I am wondering how can I change these settings?

aebruno commented 2 years ago

@pqvindesland These will be configurable in the next release of mokey. Hoping to have that out soon.