Unable to use reverse-proxy with Shibboleth IDP

[Darren Boss]

I have a similar setup, running under Kubernetes so there is HAProxy in
front of Nginx which is a reverse proxy to the IdP. I didn't seem to have
issues quite as severe but I did enable proxy protocol on the HAProxy and
again in the Nginx configuration to allow for logging of client ip
addresses in the logs but that probably won't be relevant to you if Nginx
is the first service your clients connect to.

I'm using Jetty and LE certs. I'm using the Unicon Shibboleth IdP image
with very minor changes mostly related to UI customization and for making
it a bit easier to load secrets out of Kubernetes into the IdP config.

On Fri, Jun 7, 2019 at 11:26 AM Mert Metin <mert at proximify.ca> wrote:

> Hello everybody,
>
> I am having trouble to use reverse-proxy with Shibboleth IDP.
> Let me give some details:
>
> I have a server with bunch of dockers — a docker for reverse proxy with
> NGINX, a docker for Shibboleth SP and Shibboleth IDP. SP is served over
> sp.example.com and IDP is served over idp.example.com. Both URLs have
> valid SSL certificate from Let’s encrypt.
>
> SP works perfectly fine. However, I am having trouble for the IDP.
> Whenever I go to, idp.example.com, Chrome gives ERR_INVALID_RESPONSE
> When I try with Safari, it downloads a single file — and that file
> includes a single letter “P”. Weird, right?
>
> I go through logs of both Shibboleth IDP and NGINX. The IDP logs doesn’t
> show any error. However, NGINX shows the error below:
>
> *upstream sent no valid HTTP/1.0 header while reading response header from
> upstream*
>
>
> It looks like Tomcat or Jetty in iDP container doesn’t return a proper
> HTTP header — or response?
>
> I searched through this error. However, I didn’t get anywhere. Does anyone
> have an idea?
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 

*Darren Boss*
*Senior Programmer/Analyst*
*Programmeur-analyste principal*
*darren.boss at computecanada.ca <darren.boss at computecanada.ca>*
*(o) 416.228.1234 x *230
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190607/54fa3953/attachment.html>