Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Incorrectly redirects on login via nginx reverse proxy

Abierto
  • ¿Algo no está bien?
#2,357 3 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
30/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
java, kubernetes, nginx, postgresql
Área
authentication, backend, infrastructure

Línea de trabajo

Inspecciona las URL de callback y de inicio de sesión de OAuth en la configuración de Java WebAPI y compáralas con los ajustes backend-protocol, upstream-vhost y del puerto de servicio 8080 de nginx Ingress. Reproduce el flujo de inicio de sesión de Entra ID; se considera terminado cuando la redirección posterior al callback mantiene el host HTTPS público sin :8080 y sigue la URL esperada /WebAPI/user/login/openid?redirectUrl=/home.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

When we login to ATLAS, we are redirected to Entra ID and can login, once we are redirected back to the port that the server is run on rather than the proxy.

In our implementation of Atlas with WebAPI running on kubernetes, we are utilising Microsoft Entra ID to provide authentication. In our configuration, Atlas is configured as follows:

var getUrl = window.location;
webapi_url = getUrl.protocol + "//" + getUrl.hostname + "/WebAPI/";

// WebAPI
configLocal.api = {
   name: 'ATLAS',
   url: webapi_url
};

and our API Server is configured as follows:


        - name: DATASOURCE_DRIVERCLASSNAME
          value: org.postgresql.Driver
        - name: DATASOURCE_OHDSI_SCHEMA
          value: webapi
        - name: DATASOURCE_PASSWORD
          valueFrom:
            secretKeyRef:
              key: db-password
              name: ohdsi
        - name: DATASOURCE_URL
          value: jdbc:postgresql://****.postgres.database.azure.com:5432/ohdsi
        - name: DATASOURCE_USERNAME
          value: ***@***.postgres.database.azure.com
        - name: FLYWAY_BASELINEDESCRIPTION
          value: Base Migration
        - name: FLYWAY_BASELINEONMIGRATE
          value: "true"
        - name: FLYWAY_DATASOURCE_DRIVERCLASSNAME
          value: org.postgresql.Driver
        - name: FLYWAY_DATASOURCE_PASSWORD
          valueFrom:
            secretKeyRef:
              key: db-password
              name: ohdsi
        - name: FLYWAY_DATASOURCE_URL
          value: jdbc:postgresql://***.postgres.database.azure.com:5432/ohdsi
        - name: FLYWAY_DATASOURCE_USERNAME
          value: ***@***.postgres.database.azure.com
        - name: FLYWAY_LOCATIONS
          value: classpath:db/migration/postgresql
        - name: FLYWAY_PLACEHOLDERS_OHDSISCHEMA
          value: webapi
        - name: FLYWAY_SCHEMAS
          value: webapi
        - name: FLYWAY_TABLE
          value: schema_history
        - name: SECURITY_CORS_ENABLED
          value: "true"
        - name: SECURITY_ORIGIN
          value: http://127.0.0.1
        - name: SPRING_BATCH_REPOSITORY_TABLEPREFIX
          value: webapi.BATCH_
        - name: SPRING_JPA_PROPERTIES_HIBERNATE_DEFAULT_SCHEMA
          value: webapi
        - name: SPRING_JPA_PROPERTIES_HIBERNATE_DIALECT
          value: org.hibernate.dialect.PostgreSQLDialect
        - name: flyway_baselineVersionAsString
          value: 2.2.5.20180212152023
        - name: SECURITY_PROVIDER
          value: AtlasRegularSecurity
        - name: SECURITY_OID_ENABLED
          value: "true"
        - name: SECURITY_OID_CLIENTID
          value: ***
        - name: SECURITY_OID_APISECRET
          valueFrom:
            secretKeyRef:
              key: ohdsi-appreg-client-secret
              name: ohdsi
        - name: SECURITY_OID_URL
          value: https://login.microsoftonline.com/***/v2.0/.well-known/openid-configuration
        - name: SECURITY_SSL_ENABLED
          value: "true"
        - name: JAVA_OPTS
          value: -Dserver.ssl.enabled=true -Dserver.ssl.key-store=/mnt/keystore/keystore.jks
            -Dserver.ssl.keyStoreType=JKS -Dserver.ssl.key-alias=tomcat -Dserver.ssl.key-store-password=***
            -Dserver.ssl.key-password=Ref4ct0r -Dserver.port=8080 -Dsecurity.oid.redirectUrl=https://sandbox-ohdsi.xlscsde.nhs.uk/atlas/#/welcome
            -Dsecurity.oauth.callback.api=https://sandbox-ohdsi.xlscsde.nhs.uk/WebAPI/user/oauth/callback
            -Dsecurity.oauth.callback.ui=https://sandbox-ohdsi.xlscsde.nhs.uk/atlas/#/welcome
            -Dsecurity.oauth.callback.urlResolver=query -Dshiro.successUrl=https://sandbox-ohdsi.xlscsde.nhs.uk/WebAPI/user/login/openid?redirectUrl=/home

https://sandbox-ohdsi.xlscsde.nhs.uk/atlas/#/home
Our ingress configuration is as follows:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    meta.helm.sh/release-name: ohdsi
    meta.helm.sh/release-namespace: ohdsi
    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/upstream-vhost: sandbox-ohdsi.xlscsde.nhs.uk:8080
    xlscsde.nhs.uk/dns-record: ohdsi
  labels:
    app.kubernetes.io/managed-by: Helm
    helm.toolkit.fluxcd.io/name: ohdsi
    helm.toolkit.fluxcd.io/namespace: ohdsi
  name: ohdsi-webapi
  namespace: ohdsi
spec:
  ingressClassName: nginx
  rules:
  - host: sandbox-ohdsi.xlscsde.nhs.uk
    http:
      paths:
      - backend:
          service:
            name: ohdsi-webapi
            port:
              number: 8080
        path: /WebAPI
        pathType: Prefix
  tls:
  - hosts:
    - sandbox-ohdsi.xlscsde.nhs.uk
    secretName: sandbox-ohdsi.xlscsde.nhs.uk-tls

Atlas loads fine and can talk to the web api without incident, however when we login it redirects us in the wrong direction

Expected behavior

After login via oid we should be redirected to

https://sandbox-ohdsi.xlscsde.nhs.uk/WebAPI/user/oauth/callback

this should then redirect us to:

https://sandbox-ohdsi.xlscsde.nhs.uk/WebAPI/user/login/openid?redirectUrl=/home

Actual behavior

After login via oid we should be redirected to

https://sandbox-ohdsi.xlscsde.nhs.uk/WebAPI/user/oauth/callback

then redirect us to:

https://sandbox-ohdsi.xlscsde.nhs.uk:8080/WebAPI/user/login/openid?redirectUrl=/home

Steps to reproduce behavior
  • Load atlas home page
  • Click sign in button
  • Login to Entra ID
Lenguaje dominante
Java
Estrellas
153
Forks
187
Merge medio
1 d 1 h
PR fusionados (30 d)
15

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de OHDSI/WebAPI

Todos los issues de OHDSI/WebAPI

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.