I have implemented authorization_code grant flow which works fine when my Auth Server is run locally.
A client is getting redirected to auth server login page through
/oauth/authorize
end point.On successful login it is getting redirected to the
redirect_uri
provided in the/oauth/authorize
call where it is getting theauthorization_code
.
Very well.
The problem is when the Auth Server is put behind proxy the last step where after successful login client is supposed to get the authorization_code
on redirected resource is not working at all. It is always getting redirected to Auth Server's root.
To handle this I created a UsernamePasswordAuthenticationFilter
where I configured AuthenticationSuccessHandler as below
@Bean
public SavedRequestAwareAuthenticationSuccessHandler successRedirectHandler() {
SavedRequestAwareAuthenticationSuccessHandler savedSuccessHandler = new SavedRequestAwareAuthenticationSuccessHandler();
savedSuccessHandler.setUseReferer(true);
return savedSuccessHandler;
}
@Bean
public UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter() throws Exception
{
UsernamePasswordAuthenticationFilter usernamePasswordAuthenticationFilter = new UsernamePasswordAuthenticationFilter();
usernamePasswordAuthenticationFilter.setAuthenticationManager(authenticationManager());
usernamePasswordAuthenticationFilter.setAuthenticationSuccessHandler(successRedirectHandler());
return usernamePasswordAuthenticationFilter;
}
I also did some configurations at proxy level as suggested here.
<VirtualHost *:443>
ServerName my.domain.com
ProxyPass / http://127.0.0.1:8080/
RequestHeader set X-Forwarded-Proto https
RequestHeader set X-Forwarded-Port 443
ProxyPreserveHost On
</VirtualHost>
And adding below to my application.properties
server.use-forward-headers=true
But none of the above worked. I tried some other options as well but I guess they are not worth mentioning here.
I can't figure out if something is getting missed or some misconfiguration.
Update: On successful login redirection is not happening to /ouath/authorize
itself but in case of login failure it is getting redirected to login page with /login?error
Also, it is running locally on Tomcat but on Wildfly behind proxy. I debugged it and found that there is a library in Tomcat : org.apache.coyote.http11.AbstractHttp11Processor
which maintains a RequestInfo
object holding the original /oauth/authorize
request with all the parameters. When debugged over Wildfly no such object could be found. I am sharing the below for reference. I guess now it is more related to server than proxy.
Debugging on tomcat