The following sections provide configuration examples for using different reverse proxy servers.
Apache 2 is a free open source Web server that you can configure as a reverse proxy by using the mod_proxy module.
The following configuration example exposes the IDOL Data Admin running on ida.example.com at https://localhost:443/dataadmin, using AJP to enable remote authentication. The application AJP port is 8009, and the HTTPS port is 8443.
For this configuration, you must enable the mod_proxy, mod_proxy_ajp, mod_proxy_wstunnel, and mod_ssl modules.
SSLEngine on
SSLProxyEngine on
SSLCertificateFile /path/to/my-certificate.crt
SSLCertificateKeyFile /path/to/my-key.key
<Location /dataadmin/>
AuthType YOUR_AUTH_MODULE
require valid-user
ProxyPass "ajp://ida.example.com:8009/"
ProxyPassReverse /
# Ensure WebSocket protocol is forwarded correctly
RewriteEngine on
RewriteCond %{HTTP:UPGRADE} ^Websocket$ [NC]
RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
RewriteRule /api/user/socket/(.*) wss://ida.example.com:8443/api/user/socket/$1 [P]
</Location>
The following configuration example exposes the IDOL Data Admin running on ida.example.com at https://localhost:443/dataadmin, using HTTPS to communicate with the application.
For this configuration, you must enable the mod_proxy, mod_proxy_http, mod_proxy_wstunnel, and mod_ssl modules.
SSLEngine on
SSLProxyEngine on
SSLCertificateFile /path/to/my-certificate.crt
SSLCertificateKeyFile /path/to/my-key.key
<Location /dataadmin/>
AuthType YOUR_AUTH_MODULE
require valid-user
ProxyPass "https://ida.example.com:8443/"
ProxyPassReverse /
# Ensure WebSocket protocol is forwarded correctly
RewriteEngine on
RewriteCond %{HTTP:UPGRADE} ^Websocket$ [NC]
RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
RewriteRule /api/user/socket/(.*) wss://ida.example.com:8443/api/user/socket/$1 [P]
</Location>
You can configure Apache 2 to act as a SAML service provider, which ensures that users are authenticated before passing them through to the application, and sends them to an identity provider if they are not.
For this configuration, you must install and enable the mod_auth_mellon module.
SSLEngine on
SSLProxyEngine on
SSLCertificateFile /path/to/my-certificate.crt
SSLCertificateKeyFile /path/to/my-key.key
<Location /dataadmin/>
AuthType "Mellon"
AuthName YOUR_AUTH_NAME
Require valid-user
MellonEnable "auth"
MellonSecureCookie On
MellonVariable "session_cookie"
MellonUser "NAME_ID"
MellonEndpointPath "/mellon"
MellonDefaultLoginPath "/"
# Session TTL seconds
MellonSessionLength 86400
MellonSPMetadataFile /path/to/service/provider/metadata
MellonSPPrivateKeyFile /path/to/service/provider/key/file
MellonSPCertFile /path/to/service/provier/cert/file
MellonIdPMetadataFile /path/to/idp/metadata/file
ProxyPass "https://ida.example.com:8443/"
ProxyPassReverse /
# Ensure WebSocket protocol is forwarded correctly
RewriteEngine on
RewriteCond %{HTTP:UPGRADE} ^Websocket$ [NC]
RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
RewriteRule /api/user/socket/(.*) wss://ida.example.com:8443/api/user/socket/$1 [P]
</Location>
Nginx is a free open source Web server and reverse proxy. It does not support the AJP protocol, so remote authentication is not possible.
The following example configuration exposes the IDOL Data Admin instance running on https://ida.example.com:8443/ida at https://localhost:443/dataadmin.
server {
listen 443 ssl default_server;
ssl_certificate /path/to/my-certificate.crt;
ssl_certificate_key /path/to/my-key.key
location /dataadmin/ {
proxy_pass https://ida.example.com:8443/ida;
proxy_cookie_path /ida /dataadmin;
# Ensure WebSocket protocol is forwarded correctly
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
IIS is a Web server created by Microsoft that is built into many versions of Windows. You can configure it as a reverse proxy in HTTP mode, by using the URL Rewrite and Application Request Routing (ARR) modules. In later versions of IIS, the Web server can automatically proxy WebSockets connections.
You can enable the AJP protocol by using the Apache Tomcat ISAPI redirector module.
To reverse proxy in HTTP mode, you must configure a URL Rewrite rule that redirects incoming requests to the application, and another rule that rewrites Location headers in the response.
|
|