Having issues with crowd + nginx + SSL
Asked by Doug Rowe:

Here's my current nginx config: (domain renamed to protect the innocent)  

server {  
listen 80;  
server_name crowd.\*;  
access_log off;  

client_max_body_size 10M;  
return 301 [https://crowd.example.com$request_uri;\<br\< a=""\>\> }
server {
listen 443 ssl;
server_name crowd.example.com;
access_log off;
client_max_body_size 10M;
ssl_certificate /etc/nginx/ssl/crowd.example.com.crt;
ssl_certificate_key /etc/nginx/ssl/crowd.example.com.key;
location / {
proxy_pass](https://crowd.example.com%24request_uri;%3Cbr)[http://localhost:8095/;\<br\< a=""\>\> proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
port_in_redirect off;
proxy_redirect](http://localhost:8095/;%3Cbr)<https://crowd.example.com/>/;  
}  
}  

Here's my server.xml  

\<?xml version="1.0" encoding="UTF-8"?\>  
\<Server port="8020" shutdown="SHUTDOWN"\>  

\<Service name="Catalina"\>  

\<Connector  
acceptCount="100"  
connectionTimeout="20000"  
disableUploadTimeout="true"  
enableLookups="false"  
maxHttpHeaderSize="8192"  
maxThreads="150"  
minSpareThreads="25"  
port="8095"  
redirectPort="8443"  
useBodyEncodingForURI="true"  
URIEncoding="UTF-8"  

proxyName="crowd.example.com"  
proxyPort="443"  
scheme="https"  
secure="true"/\>  

\<Engine defaultHost="localhost" name="Catalina"\>  
\<Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true"/\>  
\</Engine\>  

\<!-- To connect to an external web server (typically Apache) --\>  
\<!-- Define an AJP 1.3 Connector on port 8009 --\>  
\<Connector port="8009" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" /\>  
\</Service\>  
\<!-- Security listener. Documentation at /docs/config/listeners.html  
\<Listener className="org.apache.catalina.security.SecurityListener" /\>  
--\>  
\<!--APR library loader. Documentation at /docs/apr.html --\>  
\<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /\>  
\<!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html --\>  
\<Listener className="org.apache.catalina.core.JasperListener" /\>  
\<!-- Prevent memory leaks due to use of particular java/javax APIs--\>  
\<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /\>  
\<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /\>  
\<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /\>  

\</Server\>  

Here's my crowd.properties:  

#Tue Aug 05 15:44:15 EDT 2014  
session.lastvalidation=session.lastvalidation  
session.tokenkey=session.tokenkey  
crowd.server.url=http\\://localhost\\:8095/crowd/services/  
application.name=crowd  
http.timeout=30000  
session.isauthenticated=session.isauthenticated  
application.login.url=http\\://localhost\\:8095/crowd  
session.validationinterval=0  
application.password=fslLXYfj9DehGTmGjLqZbX  

Now, I can surf to <https://crowd.example.com>and to <https://crowd.example.com/crowd>, but after I attempt to log in, I get into a redirect cycle for some reason.  


Answers:
author: Mallmann
body: Hello Doug,

After analyzing your configurations, I found some wrong settings which I guess might be causing the behaviour you're facing.

Follow bellow your configurations with some modifications:

1. Replace your current server block which is listening to the port 443 with the following code into your nginx.conf:

```
server {	listen 443;	server_name crowd.example.com;	access_log off;	client_max_body_size 10M;	ssl on;	ssl_certificate /etc/nginx/ssl/crowd.example.com.crt;	ssl_certificate_key /etc/nginx/ssl/crowd.example.com.key;	location / { 		proxy_pass http://localhost:8095;		proxy_set_header Host $host;		proxy_set_header X-Real-IP $remote_addr;		proxy_set_header X-Forwarded-For $remote_addr;		port_in_redirect off; 		proxy_redirect https://crowd.example.com/ /; 	}}
```

2. Update your current crowd.properties file with the following:

```
#Tue Aug 05 15:44:15 EDT 2014session.lastvalidation=session.lastvalidationsession.tokenkey=session.tokenkeycrowd.server.url=https\://crowd.example.com/crowd/services/application.name=crowdhttp.timeout=30000session.isauthenticated=session.isauthenticatedapplication.login.url=https\://crowd.example.comsession.validationinterval=0application.password=fslLXYfj9DehGTmGjLqZbX
```

Remember to restart both, NGINX and Crowd, after these changes.

Please, let me know if it helped you.

Best regards,

Eduardo Mallmann

Atlassian Support


Tags: crowd-administration