I am trying to get nginx to ssl reverse proxy gerrit with http_ldap authentication. Here are my tests:
- nginx operating as an https proxy and gerrit using ldap auth -- works
- nginx operating as an http proxy and gerrit using http_ldap auth -- works
- nginx operating as an https proxy and gerrit using http_ldap auth -- fails with an configuration error alert from gerrit complaining "The HTTP server did not provide the username in the X-Remote-User header when it forwarded the request to Gerrit Code Review."
Here is what I have tried:
Works:
- http proxy with HTTP_LDAP auth: the nginx server pops up an authentication box and passes it to gerrit
gerrit config:
[auth]
type = HTTP_LDAP
gitBasicAuth = true
httpHeader = X-Remote-User
trustContainerAuth = true
[httpd]
listenUrl = proxy-http://*:8080/gerrit
nginx config:
server {
listen 80;
server_name ${HOST_NAME};
location /gerrit/ {
proxy_pass http://gerrit:8080;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Remote-User $remote_user;
}
- Works: ssl proxy and LDAP auth: gerrit does the authentication instead of the nginx webserver popping up the authentication box:
gerrit config:
[auth]
type = LDAP
gitBasicAuth = true
[httpd]
listenUrl = proxy-http://*:8080/gerrit
nginx config:
server {
listen 80;
return 301 https://$host$request_uri;
}
server {
listen 443;
server_name ${HOST_NAME};
ssl_certificate /etc/nginx/cert.crt;
ssl_certificate_key /etc/nginx/cert.key;
ssl on;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;
location /gerrit/ {
proxy_pass http://gerrit:8080;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header Host $host;
}
What doesn't work is the second nginx configuration and the first gerrit configuration (or a slight modification, where listenUrl is set to proxy-https://*:8080/gerrit
Before I give up on getting HTTP_LDAP authentication to work, I would like to see if there is some obvious configuration nit that I am missing (or an assurance the HTTP_LDAP doesn't buy anything and I should just stick with LDAP auth).