Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup the GlassFish application server behind an Apache reverse proxy. I've got it working with both port 80 and 443, but the problem is the transition between the two that occurs when a user accesses a page that requires authentication which causes Glassfish to issue a redirect to the login page, and in turn requires SSL over Apache 443/GlassFish 8181. In this case the user's browser attempts to access the origin server directly, which in my case is localhost so actually causes the user to try to access their own local system (https://localhost:8181/myapp).

To get this far I added the following to httpd.conf:

<VirtualHost *:80>
ProxyPass /myapp http://localhost:8080/myapp
ProxyPassReverse /myapp http://localhost:8080/myapp
</VirtualHost>

And the following to ssl.conf:

<VirtualHost _default_:443>
SSLProxyEngine on
ProxyPass /myapp https://localhost:8181/myapp
ProxyPassReverse /myapp https://localhost:8181/myapp
...

I've tried to add an additional ProxyPassReverse directive, but that doesn't work, probably because it can't handle switching protocols. Maybe I need to add a RewriteRule directive? Or maybe I need to enable mod_proxy_html to rewrite content?

share|improve this question
    
Are you able to have Apache do the redirecting instead of GlassFish? –  Shane Madden Mar 9 '12 at 16:13
    
I was hoping to just use the container managed security that GlassFish provides as is. If I disabled GlassFish security I would have to disallow Intranet connections directly to GlassFish and make internal users go through the Apache reverse proxy as well. I would have to port all of the different application security descriptors to Apache rewrite rules too and then they would no longer be packaged with the app. That wouldn't be the end of the world though I suppose. In the past I solved this problem by forcing all communication over SSL, but I was hoping for a better fix this time around. –  Ryan Mar 9 '12 at 17:02
    
OK, I guess having the rewrite rule in Apache will have to do. I don't want to remove it from GlassFish so I guess I'll have to live with it in two places. In Apache it looks like this: RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^/myapp/login(.*) https://%{HTTP_HOST}%{REQUEST_URI} –  Ryan Mar 9 '12 at 17:54
    
Note that if you go with the preemptive rewrite rule approach you must make a rule for each URL that triggers a login redirect (/edit-foo, /edit-bar, etc.). Also there is the issue of once the user is logged in they need to stay in SSL... –  Ryan Mar 9 '12 at 18:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.