Repository: provectus/kafka-ui
Issue: Proposal: Add info about `SERVER_USEFORWARDHEADERS` to SSO guide
Labels: type/documentation
good first issue
status/accepted
hacktoberfest

### Is your proposal related to a problem?

I recently set up kafka-ui with MSK in ECS on AWS with the intent of using SSO with Auth0 to secure the application.  I am terminating SSL on the load balancer; connections between the load balancer and the kafka-ui container are HTTP.  Following the SSO guide, I set up only the environment variables that were relevant to SSO:

```
AUTH_ENABLED=true
SECURITY_BASIC_ENABLED=true
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTID=uhvaPKIHU4ZF8Ne4B6PGvF0hWW6OcUSB
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTSECRET=YXfRjmodifiedTujnkVr7zuW9ECCAK4TcnCio-i
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI=https://dev-a63ggcut.auth0.com/
```

However, what I observed is that the redirect URI that was formed by the application and passed to Auth0 used the HTTP scheme instead of HTTPS, ostensibly because the connection between the LB and the app is non-TLS. 

### Describe the solution you'd like

After digging through a few articles online (and deducing that Spring Security is being used to facilitate authN/Z), I found that there is a Spring setting that must be enabled in my particular configuration that causes Spring to use the `X-Forwarded-For` headers to determine the originating scheme in order to form the correct redirect URI to pass to Auth0.  By setting `SERVER_USEFORWARDHEADERS` to `true`, the application now properly handles my SSO authentication with Auth0.  I propose that the SSO guide be augmented in such a way to call out the scenario in which SSL is terminated prior to the application (such as on a load balancer), the app _may_ need to be configured to respect the `X-Forwarded-For` headers (which is apparently not the default).

(tl;dr -- the docs for SSO should suggest setting `SERVER_USEFORWARDHEADERS` to `true` when TLS is terminated by a proxy.)

### Describe alternatives you've considered

None.

### Additional context

More info can be found in this SO answer: https://stackoverflow.com/a/40879393

Issue comments:
Hi, thank you for the feedback (and contribution). We'll reflect the changes in the documentation soon.
Thanks once again, done.
Thanks @Haarolean .  I hate to be a PITA, but a few days ago I attempted to deploy the latest build of `master` and this guidance was no longer working for me.  Digging deeper, it appears as if the `server.use-forward-headers` option was deprecated in Spring Boot 2.2 (and my guess is that `kafka-ui` has recently updated to a version of Spring Boot that finally has removed the setting).

The guidance from that project now is to use `server.forward-headers-strategy=native`, which would be setting `SERVER_FORWARDHEADERSSTRATEGY=native` in this project.

See https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.2-Release-Notes#deprecations-in-spring-boot-22.
@clocklear hey, yeah, we've updated boot some time ago. Thanks for this information, I'll update the docs.

Pull request review comments:

Patch that resolved the issue:
diff --git a/guides/SSO.md b/guides/SSO.md
index 2cb2e7fc603..2f1e49892cc 100644
--- a/guides/SSO.md
+++ b/guides/SSO.md
@@ -46,3 +46,6 @@ docker run -p 8080:8080 -v `pwd`/cert:/opt/cert -e AUTH_ENABLED=true \
   -e SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI=https://dev-a63ggcut.auth0.com/ \
 provectuslabs/kafka-ui:0.1.0
 ```
+
+#### Step 4 (optional)
+If you're using load balancer/proxy and use HTTP between the proxy and the app, you might wanna set `SERVER_USEFORWARDHEADERS` to true as well, for more info refer to [this issue](https://github.com/provectus/kafka-ui/issues/1017).


Test patch: