Add a uwsgi param to prevent SAML error #5577
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add the uwsgi_param 'HTTP_X_FORWARDED_PORT' to nginx configuration, This prevents the python-saml "invalid_response" error related issue : ansible#5570 and ansible#1016 Signed-off-by: loitho
|
Build failed.
|
|
recheck |
|
Build succeeded.
|
ryanpetrello
approved these changes
Jan 2, 2020
|
Build succeeded (gate pipeline).
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add the uwsgi_param 'HTTP_X_FORWARDED_PORT' to nginx configuration,
This prevents the python-saml "invalid_response" error
related issue : #5570 and #1016
Signed-off-by: loitho
SUMMARY
Hi there, I added the line uwsgi_param HTTP_X_FORWARDED_PORT 443 into the nginx configuration to prevent the following error that happens with the SAML module when running AWX with docker-compose :
ISSUE TYPE
COMPONENT NAME
AWX VERSION
ADDITIONAL INFORMATION
When the Identity Provider execute the callback back to AWX after a successfully authentication (let's say to "https://test-awx.com/sso/complete/saml/" the call is received by the Nginx server listening on the 8053 port which then "wsgi_pass" the request to the Django server.
The problem is that the Django server then see the request arriving at the 8053 port and throw the error :
Because Django determines the port it's running at by checking "HTTP_X_FORWARDED_PORT" and then the "SERVER_PORT"
https://docs.djangoproject.com/fr/3.0/ref/request-response/#django.http.HttpRequest.get_port
And because there wasn't any HTTP_X_FORWARDED_PORT header set for wsgi, it was using the default server port (8053)
Adding the uwsgi_param "HTTP_X_FORWARDED_PORT" prevent Django from throwing the invalid request error and allow for SAML to work