无法登录到负载均衡器后面的WSO2 Carbon

Question

I have a WSO2IS 5.0.0 instance running on a VM behind a load balancer. The load balancer listens for HTTPS on port 443, handles all SSL and forwards plain HTTP to the VM on port 80.

I have configured the WSO2IS instance to have only one HTTP connector on port 80 in catalina-server.xml, and configured all the URLs I can find in the config to point to the load balancer using HTTPS.

I can visit the carbon webapp via the load balancer on 443 fine. However when I successfully log in, the webapp returns a redirect to HTTP on port 80, NOT to HTTPS on port 443 as it should. This makes it impossible to use the carbon webapp.

If I change proxyPort in the HTTP connector in catalina-server.xml, it does then return a redirect to port 443 - but the URL is plain HTTP, not HTTPS, so it still fails.

How can I tell carbon to send a redirect to HTTPS even though tomcat itself is listening via HTTP?

Thanks in advance!

Answer 1

You can use proxy port in this scenario.

You can configure in tomcat/catalina-server.xml as below with 2 connectors. http url will anyway redirect to https url. Do you mean management console as webapp?

 <Connector  protocol="org.apache.coyote.http11.Http11NioProtocol"
                port="9763"
                proxyPort="80"
                bindOnInit="false"
                maxHttpHeaderSize="8192"
                acceptorThreadCount="2"
                maxThreads="250"
                minSpareThreads="50"
                disableUploadTimeout="false"
                connectionUploadTimeout="120000"
                maxKeepAliveRequests="200"
                acceptCount="200"
                server="WSO2 Carbon Server"
                compression="on"
                compressionMinSize="2048"
                noCompressionUserAgents="gozilla, traviata"
                compressableMimeType="text/html,text/javascript,application/x-javascript,application/javascript,application/xml,text/css,application/xslt+xml,text/xsl,image/gif,image/jpg,image/jpeg" 
                URIEncoding="UTF-8"/>

    <Connector  protocol="org.apache.coyote.http11.Http11NioProtocol"
                port="9443"
                proxyPort="443"
                bindOnInit="false"
                sslProtocol="TLS"
                maxHttpHeaderSize="8192"
                acceptorThreadCount="2"
                maxThreads="250"
                minSpareThreads="50"
                disableUploadTimeout="false"
                enableLookups="false"
                connectionUploadTimeout="120000"
                maxKeepAliveRequests="200"
                acceptCount="200"
                server="WSO2 Carbon Server"
                clientAuth="false"
                compression="on"
                scheme="https"
                secure="true"
                SSLEnabled="true"
                compressionMinSize="2048"
                noCompressionUserAgents="gozilla, traviata"
                compressableMimeType="text/html,text/javascript,application/x-javascript,application/javascript,application/xml,text/css,application/xslt+xml,text/xsl,image/gif,image/jpg,image/jpeg"
                URIEncoding="UTF-8"/>

You should have the mapping to your load balancer in your etc/hosts file as :

is.50.com

In Your Load balancer you should have as below. Eg, apache2

<Virtualhost *:443>
        ServerName is.50.com
        ServerAlias is.50.com
        ProxyPreserveHost On
        SSLEngine On
        SSLProxyEngine On
        SSLProxyVerify none
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerName off
        SSLCertificateFile /etc/apache2/ssl/apache.crt
        SSLCertificateKeyFile /etc/apache2/ssl/apache.key

 <Proxy *>
       Order deny,allow
       Allow from all
 </Proxy>

stickysession=JSESSIONID


ProxyPass / https://<carbonIP>:<port>/
ProxyPassReverse / https://<carbonIP>:<port>/

</Virtualhost>

Then your access URL will be, as below.

https://is.50.com/carbon

or

http://is.50.com/carbon which will redirect to https.