chef-server-webui session not working when access from external IP address

Question

I have installed chef-server on an Ubuntu 12.10 system using the official .deb package for that release. After the installation had finished I run

chef-server-ctl test

Which reported success, 0 failures.

The server - an Amazon EC2 instance - has 1 network interface, which has an internal address assigned to it. Let's say the IP address is 10.223.92.58 and hostname -f returns something like:

ip-10-223-92-58.eu-west-1.compute.internal

However, AWS EC2 allows accessing the server from the internet using 53.242.31.23 or DNS ec2-53-242-31-23.eu-west-1.compute.amazonaws.com.

In order to allow access via the Public DNS name I added the following lines to /etc/chef-server/chef-server.rb:

lb[:enable] = "false"
lb[:web_ui_fqdn] = "ec2-53-242-31-23.eu-west-1.compute.amazonaws.com"

nginx[:server_name] = "ec2-53-242-31-23.eu-west-1.compute.amazonaws.com"
nginx[:url] = "https://ec2-53-242-31-23.eu-west-1.compute.amazonaws.com"
nginx[:enable_non_ssl] = "true"

I can access the server using https://ec2-53-242-31-23.eu-west-1.compute.amazonaws.com and reach the login page. The login page will then redirect me (after successful login) to the user edit page, in order to change my password. (That's by design).

Problem:

The redirect to the user edit page will not work, as the user controller (or every other controller) will complain about a non existing session and redirect me to the login page again and again. The problem does not exist if I try to access the page from it's local DNS domain name or IP. Am I missing some configuration values?

Answer 1

I am using Chef on Azure but I believe I've discovered the correct setting for this.

@hek2mgl was very close, but his method will be overwritten everytime you reconfigure, which I don't think is practical.

In your /etc/chef-server/chef-server.rb file, add the following line:

chef_server_webui['cookie_domain'] = 'FQDN'

Where "FQDN" is your fully qualified domain name "myserver.mydomain.net", etc.

After saving this file, $ sudo chef-server-ctl reconfigure

After it completes, if you scroll up a little, under "Recipe: chef-server::default" you'll see it load your setting:

...
"session_key": "_sandbox_session",
"cookie_domain": "all",
"cookie_domain": "myserver.mydomain.net",
...

Now navigating to WebUI using myserver.mydomain.net allows you to log in.

Answer 2

I just became aware of this question, so I thought I'd chime in. I'm an engineer with Chef who has looked into this issue.

The accepted answer on this is the correct way you can get around this issue. Note that following the accepted answer will also allow you to reconfigures and keep the setting the same, since that is an issue in another one of the answers. You do not need to make all the changes that hek2mgl tried. Setting the cookie domain is enough.

Full details on my investigation can be found in our old ticketing system here: https://tickets.opscode.com/browse/CHEF-5301

This issue has also been opened in our GitHub issues here: https://github.com/opscode/chef/issues/1780

If anyone has any suggestions on how we can configure the server out of the box to avoid this, I'd appreciate it if you'd chime in on the GitHub issue, as I don't currently understand the exact cause of this issue. It appears to be a strange interaction between Rails, cookie domains, and modern browsers (this issue seems to only affect Chrome and Firefox, not Safari or IE, at the moment anyway). If you read the links I provided you can see all the details that I know.

Thanks.

Answer 3

I had this same problem, and I solved it by putting the elastic IP into my /etc/hosts with a name entry that matched my server hostname and the name I was using in DNS, and ran chef-server-ctl reconfigure.

Edit: this solution then broke cookbook uploads for me, and I had to relearn the good old AWS lesson that it's the private IP you must put in /etc/hosts. After a reconfigure both problems remained solved.

Answer 4

Finally I could solve the problem. It was related to the session settings of the chef-server-webui application.

I had to explicitly specify the session domain ec2-53-242-31-23.eu-west-1.compute.amazonaws.com in the file:

/opt/chef-server/embedded/service/chef-server-webui/config/initializers/session_store.rb

ChefServerWebui::Application.config.session_store :cookie_store, :key => '_sandbox_session', :domain => 'ec2-53-242-31-23.eu-west-1.compute.amazonaws.com'

Just using :domain => all like in the original file will not work.

Then restart chef-server to apply the settings:

chef-server-ctl restart

Note: Do not chef-server-ctl reconfigure, this will override the settings again.