search

zulip / docker-zulip

Container configurations, images, and examples for Zulip.
https://zulip.com/
Apache License 2.0
575 stars 238 forks source link

SAML Assertion Consumer Service URL has http instead of https #308

Closed intelligentops closed 1 week ago

intelligentops commented 3 years ago

Hey,

I have a clean Zulip setup with enabled SAMLAuthBackend behind a reverse proxy. I've configured SOCIAL_AUTH_SAML_ENABLED_IDPS section in settings.py and added x509cert from IdP. After that I can see server’s metadata at https://zulip.example.com/saml/metadata.xml but next Location has http scheme

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://zulip.example.com/complete/saml/" index="1"/>

that cause my browser to show warning during the SAML assertion exchange.

Could you please help find the place where I can change the scheme? Thanks!

eriktews commented 3 years ago

Are you using Nginx? When so, you need to add a line line:

proxy_set_header X-Forwarded-Proto $scheme;
eriktews commented 3 years ago

I also added this to the docs here:

https://github.com/zulip/zulip/pull/19442

timabbott commented 3 years ago

That does sound correct, thanks for the fix!

timabbott commented 1 week ago

This is one of the various reverse proxy configuration issues fixed via the work in https://github.com/zulip/zulip/commit/62642b899c12673bb76c958342b106c0863a3552.