1

I have a Mac Mini with OS X Server 5.1.7 running. I have a service running locally accessible via http://127.0.0.1:3000/ask (without authentication) and I want to make it available to the outside but with authentication using OS X Server directory.

So, in the websites section I created a new website named intranet.mydomain.com which is accessible only to "Intranet Users" (a group I created).

After doing this, I try to access https://intranet.mydomain.com , it asks for username and password and it works with the credentials of a user that is part of "Intranet Users".

Now, to setup the reverse proxy, I go to to the file

/Library/Server/Web/Config/apache2/sites/0000_127.0.0.1_34543_intranet.mydomain.com.conf

And add the following:

ProxyPass /ask http://127.0.0.1:3000/ask

ProxyPassReverse /ask http://127.0.0.1:3000/ask

after the Directory node.

Now, when accessing https://intranet.mydomain.com/ask , I get to the internal service but no authentication is requested. Which should be fine, I believe, since in the XML config only the Directory node has the authentication configured:

<Directory "/Library/Server/Web/Data/Sites/intranet.mydomain.com">
    Options All -Indexes -ExecCGI -Includes +MultiViews
    AllowOverride None
    <IfModule mod_dav.c>
        DAV Off
    </IfModule>
    <IfDefine !WEBSERVICE_ON>
        Require all denied
        ErrorDocument 403 /customerror/websitesoff403.html
    </IfDefine>
    AuthType Digest
    AuthName "Realm ID 75040558"
    <Limit PUT DELETE PROPPATCH PROPFIND MKCOL COPY MOVE LOCK UNLOCK>
      Require no-user
    </Limit>
    <Limit GET HEAD OPTIONS CONNECT POST>
      Require group memberusers
    </Limit>
    <IfDefine !WEBSERVICE_ON>
        Require all denied
        ErrorDocument 403 /customerror/websitesoff403.html
    </IfDefine>
</Directory>

So, to make it global (for both filesystem and paths not in filesystem), I changed the Directory node to a location node, like this:

<Location "/">
    Options All -Indexes -ExecCGI -Includes +MultiViews
    AllowOverride None
    <IfModule mod_dav.c>
        DAV Off
    </IfModule>
    <IfDefine !WEBSERVICE_ON>
        Require all denied
        ErrorDocument 403 /customerror/websitesoff403.html
    </IfDefine>
    AuthType Digest
    AuthName "Realm ID 75040558"
    <Limit PUT DELETE PROPPATCH PROPFIND MKCOL COPY MOVE LOCK UNLOCK>
      Require no-user
    </Limit>
    <Limit GET HEAD OPTIONS CONNECT POST>
      Require group memberusers
    </Limit>
    <IfDefine !WEBSERVICE_ON>
        Require all denied
        ErrorDocument 403 /customerror/websitesoff403.html
    </IfDefine>
</Location>

After doing this, accessing the route of my domain, I'm asked for authentication and I can login. However, accessing the path https://intranet.mydomain.com/ask I'm asked for authentication (all good!) but it does not accept any username/password of valid user (note that it works for the / but not for /ask).

Any idea why?

Here's my complete config file for this website before changing the Directory to Location:

<VirtualHost 127.0.0.1:34543>
    ServerName https://intranet.mydomain.com:443
    ServerAdmin admin@example.com
    DocumentRoot "/Library/Server/Web/Data/Sites/intranet.mydomain.com"
    DirectoryIndex index.html index.php default.html
    CustomLog /var/log/apache2/access_log combinedvhost
    ErrorLog /var/log/apache2/error_log
    <IfModule mod_ssl.c>
        SSLEngine Off
        SSLCipherSuite "HIGH:MEDIUM:!MD5:!RC4"
        SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2
        SSLProxyEngine On
        SSLCertificateFile "/etc/certificates/intranet.mydomain.com.A86175C9AFAC45AA2D0D590A8B94ACC1455519F8.cert.pem"
        SSLCertificateKeyFile "/etc/certificates/intranet.mydomain.com.A86175C9AFAC45AA2D0D590A8B94ACC1455519F8.key.pem"
        SSLCertificateChainFile "/etc/certificates/intranet.mydomain.com.A86175C9AFAC45AA2D0D590A8B94ACC1455519F8.chain.pem"
        SSLProxyProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerName off
    </IfModule>
    <Directory "/Library/Server/Web/Data/Sites/intranet.mydomain.com">
        Options All -Indexes -ExecCGI -Includes +MultiViews
        AllowOverride None
        <IfModule mod_dav.c>
            DAV Off
        </IfModule>
        <IfDefine !WEBSERVICE_ON>
            Require all denied
            ErrorDocument 403 /customerror/websitesoff403.html
        </IfDefine>
        AuthType Digest
        AuthName "Realm ID 75040558"
        <Limit PUT DELETE PROPPATCH PROPFIND MKCOL COPY MOVE LOCK UNLOCK>
          Require no-user
        </Limit>
        <Limit GET HEAD OPTIONS CONNECT POST>
          Require group memberusers
        </Limit>
        <IfDefine !WEBSERVICE_ON>
            Require all denied
            ErrorDocument 403 /customerror/websitesoff403.html
        </IfDefine>
    </Directory>
    ProxyPass /ask http://127.0.0.1:3000/ask
    ProxyPassReverse /ask http://127.0.0.1:3000/ask
</VirtualHost>
  • What is your AuthDigestProvider (and associated configuration) and what context is it in? – Unbeliever Sep 25 '16 at 19:22
  • @Unbeliever I just did set up the Open Directory of OS X Server and did all configs via the UI so I'm not sure what those values are (nor did they existed, I'm not an expert on this subject). Any idea what file I should look for or where to find the parameters you asked for? – Miguel Ribeiro Sep 25 '16 at 20:06
  • It's part of the auth digest setup. I'm afraid I've no idea where it might be in OSX. In most setups I would expect it to be with the other Auth directives. You'll just need to search all your configuration files. AuthDigest defaults to 'file', so if you do not have one then we need to know the context the AuthUserFile directive is in. – Unbeliever Sep 25 '16 at 20:16
  • I really like your method for adding the services to DNS on OSX Server, because in Server.app you can't use port numbers or specific pages, and that actually solved a little side problem for me, as well. – bourneN5years Sep 29 '16 at 20:19
  • Where are the allowed users defined? It is not the same as the OD Users or local OSX users, right... – bourneN5years Sep 29 '16 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.