Cannot manage Glewlwyd

Radiergummi commented

2018-01-12 18:42:04 +01:00

(Migrated from github.com)

Hey there, coming from rafaelhdr/glewlwyd-oauth2-server#3, I just set up glewlwyd on a test server behind nginx (which handles SSL, among others). I followed the installation steps to the point and got Glewlwyd running, the web app is accessible, I can log in, too. But the index page continues to tell me both "Hello username" and "Please log in to the application":
bildschirmfoto 2018-01-12 um 18 40 44

Clicking on login, I'm told "You are connected as username, What do you wish for?". I can successfully change my profile data at /profile.html.

Looking at the sessions table, though, there seems to be something wrong:
bildschirmfoto 2018-01-12 um 18 30 06

For reference, here's my nginx configuration which should fine, I think. What it does:

Redirect HTTP to HTTPS
Serve static files through nginx (nothing against Ulfius, I just like my web servers to stay consistent) if possible, otherwise through the glewlwyd upstream
Serve /api and /config through the glewlwyd upstream

# redirect to HTTPS
server {
  listen      80;
  server_name auth.server.tld;

  location / {
    return 301  https://$host$request_uri;
  }
}

server {
  listen      443 ssl http2;
  server_name auth.server.tld;

  ssl_certificate     /etc/nginx/certs/auth.server.tld/fullchain.pem;
  ssl_certificate_key /etc/nginx/certs/auth.server.tld/privkey.pem;
  include             ssl.conf;

  location @auth {
    proxy_pass       http://auth;

    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme; 
  }

  location /admin {
    root /var/www/auth/public;
    index index.html;

    try_files $uri $uri/ @auth;
  }

  location /api {
    try_files $uri @auth;
  }

  location /config {
    try_files $uri @auth;
  }
}

Relevant glewlwyd.conf lines:

# url prefix
url_prefix="api"

# path to static files for /admin url
static_files_path="/var/www/auth/public"

# static files prefix
static_files_prefix = "admin"

# login and grant urls
login_url="https://auth.db.sevigne.de/admin/login.html?"
grant_url="https://auth.db.sevigne.de/admin/grant.html?"

Any idea what is wrong here? I'm sure I've made a stupid mistake somewhere.

On a side note - how on earth did you come up with the name? It sounds a little galic to me, but considering you're from Québec City that's somehow improbable 😄

Hey there, coming from rafaelhdr/glewlwyd-oauth2-server#3, I just set up glewlwyd on a test server behind nginx (which handles SSL, among others). I followed the installation steps to the point and got Glewlwyd running, the web app is accessible, I can log in, too. But the index page continues to tell me both "Hello username" and "Please log in to the application": <img width="779" alt="bildschirmfoto 2018-01-12 um 18 40 44" src="https://user-images.githubusercontent.com/6115429/34887823-227394ea-f7c8-11e7-8257-7012b7830184.png"> Clicking on login, I'm told "You are connected as username, What do you wish for?". I can successfully change my profile data at `/profile.html`. Looking at the sessions table, though, there seems to be something wrong: <img width="1165" alt="bildschirmfoto 2018-01-12 um 18 30 06" src="https://user-images.githubusercontent.com/6115429/34887406-a8919da8-f7c6-11e7-83ce-207c83f3ed55.png"> For reference, here's my nginx configuration which should fine, I think. What it does: 1. Redirect HTTP to HTTPS 2. Serve static files through nginx (nothing against Ulfius, I just like my web servers to stay consistent) if possible, otherwise through the glewlwyd upstream 3. Serve `/api` and `/config` through the glewlwyd upstream ```nginx # redirect to HTTPS server { listen 80; server_name auth.server.tld; location / { return 301 https://$host$request_uri; } } server { listen 443 ssl http2; server_name auth.server.tld; ssl_certificate /etc/nginx/certs/auth.server.tld/fullchain.pem; ssl_certificate_key /etc/nginx/certs/auth.server.tld/privkey.pem; include ssl.conf; location @auth { proxy_pass http://auth; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location /admin { root /var/www/auth/public; index index.html; try_files $uri $uri/ @auth; } location /api { try_files $uri @auth; } location /config { try_files $uri @auth; } } ``` Relevant `glewlwyd.conf` lines: ``` # url prefix url_prefix="api" # path to static files for /admin url static_files_path="/var/www/auth/public" # static files prefix static_files_prefix = "admin" # login and grant urls login_url="https://auth.db.sevigne.de/admin/login.html?" grant_url="https://auth.db.sevigne.de/admin/grant.html?" ``` Any idea what is wrong here? I'm sure I've made a stupid mistake somewhere. > On a side note - how on earth did you come up with the name? It sounds a little galic to me, but considering you're from Québec City that's somehow improbable 😄

Radiergummi commented

2018-01-12 19:41:27 +01:00

(Migrated from github.com)

Ah-ha! Got the misfit. To work with Glewlwyd, nginx needs the following additional proxy directives:

proxy_set_header   Authorization $http_authorization;
proxy_pass_header  Authorization;

...which is strange - I've reverse-proxied several applications behind nginx but never needed to manually pass the Auth header. Oh well, there it is.
Maybe this configuration may help someone else.

Ah-ha! Got the misfit. To work with Glewlwyd, nginx needs the following additional proxy directives: ```nginx proxy_set_header Authorization $http_authorization; proxy_pass_header Authorization; ``` ...which is strange - I've reverse-proxied several applications behind nginx but never needed to manually pass the Auth header. Oh well, there it is. Maybe this configuration may help someone else.

babelouest commented

2018-01-12 19:58:00 +01:00

(Migrated from github.com)

Hello @Radiergummi ,

I was writing to you that I don't know yet how to solve your problem, good thing you found out before I click the Comment button :)

Does this mean that you now have Glewlwyd working properly?

Anyway, that's a very good thing to know, I will update the documentation to add nginx special tricks, thanks!

To answer your side question, Glewlwyd comes from the name of a Knight of the Round Table that is also the Chief Gatekeeper at Camelot, so you were right, it's britain-related. Even if I'm not from there, I have the habit to name all of my projects with a name that is related to the Matter of Britain, like Ulfius, Taliesin or Orcania, and the goes back to me watching Holy Grail from The Monty Pythons...

Hello @Radiergummi , I was writing to you that I don't know yet how to solve your problem, good thing you found out before I click the `Comment` button :) Does this mean that you now have Glewlwyd working properly? Anyway, that's a very good thing to know, I will update the documentation to add nginx special tricks, thanks! > To answer your side question, Glewlwyd comes from the name of a Knight of the Round Table that is also the [Chief Gatekeeper at Camelot](https://en.wikipedia.org/wiki/Glewlwyd_Gafaelfawr), so you were right, it's britain-related. Even if I'm not from there, I have the habit to name all of my projects with a name that is related to the [Matter of Britain](https://en.wikipedia.org/wiki/Matter_of_Britain), like [Ulfius](https://github.com/babelouest/ulfius), [Taliesin](https://github.com/babelouest/taliesin) or [Orcania](https://github.com/babelouest/orcania), and the goes back to me watching Holy Grail from The Monty Pythons...

Radiergummi commented

2018-01-12 20:36:19 +01:00

(Migrated from github.com)

Hi @babelouest,
yep, I got it working properly as far as I can see... There's only one issue left - as you've maybe seen from the configuration above, I've set the webapp URL to /admin - just personal preference. That works almost, but there's a hard coded reference to /app in glewlwyd.react.js on line 48. I've tried to rename it to my URI, but that seems to lock me out from actually managing Glewlwyd, so I just created a rewrite rule to redirect /app/index.html to /admin/index.html.
Wondering why this happens, though? Maybe it's because changing the configuration changes my JWT, too?

And thank you for clarifying the name, I like that idea!

Hi @babelouest, yep, I got it working properly as far as I can see... There's only one issue left - as you've maybe seen from the configuration above, I've set the webapp URL to `/admin` - just personal preference. That works *almost*, but there's a hard coded reference to `/app` in [glewlwyd.react.js on line 48](https://github.com/babelouest/glewlwyd/blob/master/webapp/app/glewlwyd.react.js#L48). I've tried to rename it to my URI, but that seems to lock me out from actually managing Glewlwyd, so I just created a rewrite rule to redirect `/app/index.html` to `/admin/index.html`. Wondering why this happens, though? Maybe it's because changing the configuration changes my JWT, too? And thank you for clarifying the name, I like that idea!

babelouest commented

2018-01-12 22:26:34 +01:00

(Migrated from github.com)

I'll make a new issue for the prefix problem then, thanks, I'm closing this issue now.

Rows
Columns

Cannot manage Glewlwyd #32