spinnaker: [Gate]: Redirect URL after login is not correct if not terminating SSL at the server

Hi! I’m a colleague of @vide . We found out how to fix this. This works for us:

server:
  tomcat:
    protocolHeader: X-Forwarded-Proto
    remoteIpHeader: X-Forwarded-For
    internalProxies: .*
    httpsServerPort: X-Forwarded-Port

The proxy has to set X-Forwarded-Port header, otherwise you should hardcode the original port.

We figure this out reading Tomcat’s documentation, here.

Hi there,

attaching to this issue as it seems related. I was not able to configure gate/deck behind a reverse proxy terminating TLS and appending a custom URI; the redirection to login service happens correctly, but then the actual login POST does not include the additional URI path.

Spinnaker version: 1.16.0

Configuration bits:

• api and UI custom URL set by hal

hal config security api edit --override-base-url https://domain.com/spinnaker-api
hal config security ui edit --override-base-url https://domain.com/spinnaker

• gate-local.yml as per https://github.com/spinnaker/spinnaker/issues/1630#issuecomment-402712481

Logs from the httpd reverse proxy when landing on authentication page:

IP - - [11/Sep/2019:11:14:32 +0200] "GET /spinnaker-api/login HTTP/1.1" 200 632 "https://domain.com/spinnaker/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36" 

<putting credentials in and clicking sign in>

IP - - [11/Sep/2019:11:14:41 +0200] "POST /login HTTP/1.1" 404 203 "https://domain.com/spinnaker-api/login" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36"

The problem I see is that the POST /login should have been POST /spinnaker-api/login. Any idea where this is handled or if it is configurable? Thanks for you help

I think that’s a good idea.

On Fri, Jan 18, 2019, 9:44 AM Ethan Rogers <notifications@github.com wrote:

@ttomsu https://github.com/ttomsu thoughts on adding the above to Gate’s halconfig/gate.yml? I think this is a common enough problem that it would be good to drop in by default.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/spinnaker/spinnaker/issues/1630#issuecomment-455569046, or mute the thread https://github.com/notifications/unsubscribe-auth/AMiGLiCIMlh0ju_h5M7661ol6yrX4N0jks5vEd20gaJpZM4NVurO .

For those who uses Spinnaker deployment via helm (or directly hal) with istio gateway in version < 1.1.0 :

There is problem with X-Forwarded-Proto when terminating SSL on ELB: https://github.com/istio/istio/issues/7964

Workaround is bellow:

helm value.yaml file changes (or gate-local.yml file):

      gate-local.yml: |-
        server:
          tomcat:
            protocolHeader: X-Forwarded-New
            remoteIpHeader: X-Forwarded-For
            internalProxies: .*
            httpsServerPort: X-Forwarded-Port

For the virtual file to expose gate externally - keep in mind that domains for gate and deck (dashboard) should be different:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: spin-gate
spec:
  hosts:
  - "spinnaker-api.domain.com"
  gateways:
  - spinnaker-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: spin-gate
        port:
          number: 8084
    appendHeaders:
        "X-Forwarded-New": "https"

There is an option to use istio filters to replace headers but I didn’t try this out.

For istio version >= 1.1.0 there is a possibility to remove and add the headers

I just installed Spinnaker 1.9.0 and found this issue is gone. Also tried 1.8.5 and the issue is still there.

Wondering what changes have merged into 1.9.0 but I am happy to see it is gone and will migrate to 1.9.0 version.

@vide I tried your approach, but it does not resolve my issue. do you mean put followings into ~/.hal/default/profiles/gate-local.yml and redeploy spinnaker?

server:
  tomcat:
    protocolHeader: X-Forwarded-Proto
    remoteIpHeader: X-Forwarded-For
    internalProxies: .*
    httpsServerPort: X-Forwarded-Port

my case is that SSL terminates at ingress controller (traefik) and I also tried nodePort (SSL terminates at deck and gate), the URL redirect always works for chrome, but does not work for firefox.