0

I am trying to get nginx to ssl reverse proxy gerrit with http_ldap authentication. Here are my tests:

  • nginx operating as an https proxy and gerrit using ldap auth -- works
  • nginx operating as an http proxy and gerrit using http_ldap auth -- works
  • nginx operating as an https proxy and gerrit using http_ldap auth -- fails with an configuration error alert from gerrit complaining "The HTTP server did not provide the username in the X-Remote-User header when it forwarded the request to Gerrit Code Review."

Here is what I have tried:

Works:

  • http proxy with HTTP_LDAP auth: the nginx server pops up an authentication box and passes it to gerrit

gerrit config:

[auth]
    type = HTTP_LDAP
    gitBasicAuth = true
    httpHeader = X-Remote-User
    trustContainerAuth = true
[httpd]
    listenUrl = proxy-http://*:8080/gerrit

nginx config:

server {
    listen       80;
    server_name  ${HOST_NAME};

    location /gerrit/ {
        proxy_pass    http://gerrit:8080;
        proxy_set_header    X-Forwarded-For $remote_addr;
        proxy_set_header    Host $host;
        proxy_set_header    X-Remote-User $remote_user;
    }
  • Works: ssl proxy and LDAP auth: gerrit does the authentication instead of the nginx webserver popping up the authentication box:

gerrit config:

[auth]
    type = LDAP
    gitBasicAuth = true
[httpd]      
    listenUrl = proxy-http://*:8080/gerrit

nginx config:

server {
    listen 80;
    return 301 https://$host$request_uri;
}

server {

    listen 443;
    server_name ${HOST_NAME};

    ssl_certificate           /etc/nginx/cert.crt;
    ssl_certificate_key       /etc/nginx/cert.key;

    ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    location /gerrit/ {
        proxy_pass    http://gerrit:8080;
        proxy_set_header    X-Forwarded-For $remote_addr;
        proxy_set_header    Host $host;
    }

What doesn't work is the second nginx configuration and the first gerrit configuration (or a slight modification, where listenUrl is set to proxy-https://*:8080/gerrit

Before I give up on getting HTTP_LDAP authentication to work, I would like to see if there is some obvious configuration nit that I am missing (or an assurance the HTTP_LDAP doesn't buy anything and I should just stick with LDAP auth).

sfried
  • 127
  • 7
  • You are missing a `proxy_set_header X-Remote-User $remote_user;` in the second `nginx` configuration file. – Richard Smith Mar 01 '16 at 08:15
  • Unfortunately, that wasn't it either. – sfried Mar 01 '16 at 23:42
  • For gerrit config, do you need to pass the loginUrl prop? I'm wondering if gerrit is assuming that you are already logged in and you're not. – user2016820 Mar 02 '16 at 02:28
  • I don't think so, but nginx didn't pop up the user/password box. I just went with auth=LDAP, presuming that TLS would protect the credentials and thus Digest Authentication (which I presume, possibly falsely) gerrit was otherwise using to protect the credentials. – sfried Mar 02 '16 at 18:21

0 Answers0