<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1" bgcolor="#FFFFFF">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">rewriting is more expensive then getting the web server to return the right prefix. Is that an option? Usually its just a bug that needs a minor patch to fix.<br>
<br>
Thanks,<br>
Kevin<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF50872"><font face="Tahoma" size="2" color="#000000"><b>From:</b> Adam Young [ayoung@redhat.com]<br>
<b>Sent:</b> Friday, August 05, 2016 3:06 PM<br>
<b>To:</b> openstack-dev@lists.openstack.org<br>
<b>Subject:</b> Re: [openstack-dev] [keystone][tripleo] Federation, mod_mellon, and HA Proxy<br>
</font><br>
</div>
<div></div>
<div>
<div class="moz-cite-prefix">On 08/05/2016 04:54 PM, Adam Young wrote:<br>
</div>
<blockquote type="cite">On 08/05/2016 04:52 PM, Adam Young wrote: <br>
<blockquote type="cite">Today I discovered that we need to modify the HA proxy config to tell it to rewrite redirects. Otherwise, I get a link to
<br>
<br>
<a class="moz-txt-link-freetext" href="http://openstack.ayoung-dell-t1700.test:5000/v3/mellon/postResponse" target="_blank">http://openstack.ayoung-dell-t1700.test:5000/v3/mellon/postResponse</a>
<br>
<br>
<br>
Which should be https, not http. <br>
<br>
<br>
I mimicked the lines in the horizon config so that the keystone section looks like this:
<br>
<br>
<br>
listen keystone_public <br>
bind 10.0.0.4:13000 transparent ssl crt /etc/pki/tls/private/overcloud_endpoint.pem
<br>
bind 172.16.2.5:5000 transparent <br>
mode http <br>
redirect scheme https code 301 if { hdr(host) -i 10.0.0.4 } !{ ssl_fc } <br>
rsprep ^Location:\ <a class="moz-txt-link-freetext" href="UrlBlockedError.aspx" target="_blank">
http://(.*)</a> Location:\ https://\1 <br>
http-request set-header X-Forwarded-Proto https if { ssl_fc } <br>
http-request set-header X-Forwarded-Proto http if !{ ssl_fc } <br>
server overcloud-controller-0 172.16.2.8:5000 check fall 5 inter 2000 rise 2 <br>
server overcloud-controller-1 172.16.2.6:5000 check fall 5 inter 2000 rise 2 <br>
server overcloud-controller-2 172.16.2.9:5000 check fall 5 inter 2000 rise 2 <br>
<br>
And.. it seemed to work the first time, but not the second. Now I get <br>
<br>
"Secure Connection Failed <br>
<br>
The connection to openstack.ayoung-dell-t1700.test:5000 was interrupted while the page was loading."
<br>
<br>
Guessing the first success was actually a transient error. <br>
<br>
So it looks like my change was necessary but not sufficient. <br>
<br>
This is needed to make mod_auth_mellon work when loaded into Apache, and Apache is running behind HA proxy (Tripleo setup).
<br>
<br>
<br>
There is no SSL setup inside the Keystone server, it is just doing straight HTTP. While I'd like to change this long term, I'd like to get things working this way first, but am willing to make whatever changes are needed to get SAML and Federation working
soonest. <br>
<br>
<br>
<br>
<br>
</blockquote>
Ah...just noticed the redirect is to :5000, not port :13000 which is the HA Proxy port.
<br>
</blockquote>
<br>
OK, this is due to the SAML request:<br>
<br>
<br>
<pre id="txt"><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_5089011BEBD0F6B82074F67E904F598D"
Version="2.0"
IssueInstant="2016-08-05T21:55:18Z"
Destination=<a class="moz-txt-link-rfc2396E" href="https://identity.ayoung-dell-t1700.test/auth/realms/openstack/protocol/saml" target="_blank">"https://identity.ayoung-dell-t1700.test/auth/realms/openstack/protocol/saml"</a>
Consent="urn:oasis:names:tc:SAML:2.0:consent:current-implicit"
ForceAuthn="false"
IsPassive="false"
AssertionConsumerServiceURL=<a class="moz-txt-link-rfc2396E" href="https://openstack.ayoung-dell-t1700.test:5000/v3/mellon/postResponse" target="_blank">"https://openstack.ayoung-dell-t1700.test:5000/v3/mellon/postResponse"</a>
>
<saml:Issuer><a class="moz-txt-link-freetext" href="https://openstack.ayoung-dell-t1700.test:5000/v3/mellon/metadata" target="_blank">https://openstack.ayoung-dell-t1700.test:5000/v3/mellon/metadata</a></saml:Issuer>
<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
AllowCreate="true"
/>
</samlp:AuthnRequest>
</pre>
<br>
My guess is HA proxy is not passing on the proper, and the mod_auth_mellon does not know to rewrite it from 5000 to 13000<br>
<br>
<br>
<blockquote type="cite"><br>
<br>
__________________________________________________________________________ <br>
OpenStack Development Mailing List (not for usage questions) <br>
Unsubscribe: <a class="moz-txt-link-abbreviated" href="mailto:OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a> <br>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
<br>
</blockquote>
<p><br>
</p>
</div>
</div>
</div>
</body>
</html>