0

Im having trouble properly setting up Nginx as a reverse proxy for a tomcat hosted application, which uses spring security for authentication. The spring authentication module on the application is rejecting logins with

2018-11-06 19:30:01 DEBUG http-nio-8443-exec-398 @ 1951e0f24163 [OneTimePasswordAuthenticationFilter] - Authentication request failed: org.springframework.security.authentication.AuthenticationServiceException: Authentication method not supported: GET

The Nginx logs appear to be sending the authentication as GET requests, and I dont understand why, but I can see the failure :

192.168.0.1 - - [06/Nov/2018:18:08:56 +0000] "POST /rear/j_spring_security_check HTTP/1.1" 302 161 "https://nginx_server/remote_rear/login/auth?login_error=1" "Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "-"
192.168.0.1 - - [06/Nov/2018:18:08:56 +0000] "GET /remote_rear/j_spring_security_check HTTP/1.1" 302 0 "https://nginx_server/remote_rear/login/auth?login_error=1" "Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "-"
192.168.0.1 - - [06/Nov/2018:18:08:56 +0000] "GET /rear/login/authfail;jsessionid=81EF0C82C98FC746D7641E6845E105D7?login_error=1 HTTP/1.1" 302 161 "https://nginx_server/remote_rear/login/auth?login_error=1" "Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "-"

My current proxy configuration, based on what I was able to google and test is:

server {
   listen 443 default_server ssl;
        location /remote_rear {
            proxy_set_header  Host  $http_host;
            proxy_set_header X_FORWARDED_PROTO '$https';
            proxy_set_header  X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass      https://real_server:8443/rear;
            #proxy_redirect     https://real_server:8443/rear /rear;
            proxy_redirect     http://$host https://$host;
        }
        location /rear {
            proxy_set_header Host $http_host;
            proxy_set_header X_FORWARDED_PROTO '$https';
            proxy_set_header  X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            rewrite ^/rear/(.*)$ /remote_rear/$1 redirect;
        }
}

I am really stumped as to why the j_spring_security_check URL is being sent as GET instead of POST, and I would really appreciate someone explaining what I am doing wrong, and how I can fix it. Thanks a lot in advance!

2
  • What does your browser network log tell? Does it POST or GET only? You'd add more Tomcat log, Spring configuration and maybe the login Form HTML
    – Selaron
    Nov 7, 2018 at 9:24
  • Unfortunately I dont have access to the tomcat log or spring configuration, nor would I be able to recognize it if I saw it. What I do know is, when using it without a proxy, presents a dialog box after login, for entering an OTP value. This isnt seen when proxying.
    – Unpossible
    Nov 14, 2018 at 14:04

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.