[xwiki-users] Apache settings
Hello again, we are running a tomcat-server "behind" an apache-server. In order to redirect the request we use the following configuration: <VirtualHost *:80> ServerName www.my-domain.de ServerAlias my-domain.de Redirect permanent / https://www.my-domain.de/ </VirtualHost> <VirtualHost *:443> ServerName www.my-domain.de SSLEngine On SSLProxyEngine On SSLCertificateFile /etc/apache2/ssl/my-domain.crt SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key <Proxy *> Order allow,deny Allow from all </Proxy> Redirect / /xwikiv2/ ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 ProxyPreserveHost On </VirtualHost> So all communication should be encrypted and the user should immediately be redirected to the wiki. With these settings we encounter a strange behaviour. For example the Blog refuses to create a new category (see: [xwiki-users] Server not responding when creating a new Blog-Category). If I point my browser directly to my-domain.de:8080 I can create categories. Is the config file correct? Is there a better way? Cheers, Stephanie
On 04/18/2011 01:28 PM, [email protected] wrote:
Hello again,
we are running a tomcat-server "behind" an apache-server. In order to redirect the request we use the following configuration:
<VirtualHost *:80> ServerName www.my-domain.de ServerAlias my-domain.de Redirect permanent / https://www.my-domain.de/ </VirtualHost>
<VirtualHost *:443> ServerName www.my-domain.de
SSLEngine On SSLProxyEngine On
SSLCertificateFile /etc/apache2/ssl/my-domain.crt SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key
<Proxy *> Order allow,deny Allow from all </Proxy>
Redirect / /xwikiv2/
ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 ProxyPreserveHost On </VirtualHost>
So all communication should be encrypted and the user should immediately be redirected to the wiki.
With these settings we encounter a strange behaviour. For example the Blog refuses to create a new category (see: [xwiki-users] Server not responding when creating a new Blog-Category). If I point my browser directly to my-domain.de:8080 I can create categories.
Is the config file correct? Is there a better way?
I think this is caused by the fact that the container (Tomcat) doesn't know the connection is secure (HTTPS) and tries to generate absolute URLs pointing to http instead of https. I don't know how to forward the information that the connection is secure from httpd to tomcat, but this could be a good starting point into fixing the problem. -- Sergiu Dumitriu http://purl.org/net/sergiu/
Depending on the version you use, and how much you tuned it, using a different "context name" than /xwiki/ is likely to produce bizarre behaviours i believe. Are you sure you need the <Proxy> section? Isn't that the door towards opening your server to be exploited as a proxy to go outside? paul Le 18 avr. 2011 à 13:28, [email protected] a écrit :
Redirect / /xwikiv2/
ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 ProxyPreserveHost On </VirtualHost>
So all communication should be encrypted and the user should immediately be redirected to the wiki.
With these settings we encounter a strange behaviour. For example the Blog refuses to create a new category (see: [xwiki-users] Server not responding when creating a new Blog-Category). If I point my browser directly to my-domain.de:8080 I can create categories.
Is the config file correct? Is there a better way?
Hi Stephanie, Can you try to replace the ProxyPass part by: ProxyPass /xwikiv2 ajp://localhost:8009/xwikiv2<http://localhost:8080/xwikiv2>
ProxyPassReverse /xwikiv2 ajp://localhost:8009/xwikiv2<http://localhost:8080/xwikiv2>
Let me know if it's better. Regards, Guillaume 2011/4/18 Paul Libbrecht <[email protected]>
Depending on the version you use, and how much you tuned it, using a different "context name" than /xwiki/ is likely to produce bizarre behaviours i believe.
Are you sure you need the <Proxy> section? Isn't that the door towards opening your server to be exploited as a proxy to go outside?
paul
Le 18 avr. 2011 à 13:28, [email protected] a écrit :
Redirect / /xwikiv2/
ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 ProxyPreserveHost On </VirtualHost>
So all communication should be encrypted and the user should immediately be redirected to the wiki.
With these settings we encounter a strange behaviour. For example the Blog refuses to create a new category (see: [xwiki-users] Server not responding when creating a new Blog-Category). If I point my browser directly to my-domain.de:8080 I can create categories.
Is the config file correct? Is there a better way?
_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Guillaume Fenollar [email protected] Skype: guillaume.fenollar
Stephanie - I use mod_jk for other reasons.. but mod_proxy_ajp is similar.. there is no reason why this should not work .. Make some changes though.. In your httpd conf where you have your virtual host defined change ServerName to the full address ServerName https://www.my-domain.de Dont proxy to tomcat via http... use tomcat in ajp mode .. disable port :8080 and server xwiki over :8009 only to local host via your <tomcat location>/conf/server.xml file. (usually all you need to do is comment the 8080 stuff and uncomment the 8009. your proxy string will look something like this then.. ProxyPass /xwikiv2 ajp://localhost:8009/<xwiki instance> ------ thanks kevin.foote On Mon, 18 Apr 2011, [email protected] wrote: -> Hello again, -> -> we are running a tomcat-server "behind" an apache-server. In order to -> redirect the request we use the following configuration: -> -> <VirtualHost *:80> -> ServerName www.my-domain.de -> ServerAlias my-domain.de -> Redirect permanent / https://www.my-domain.de/ -> </VirtualHost> -> -> <VirtualHost *:443> -> ServerName www.my-domain.de -> -> SSLEngine On -> SSLProxyEngine On -> -> SSLCertificateFile /etc/apache2/ssl/my-domain.crt -> SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key -> -> <Proxy *> -> Order allow,deny -> Allow from all -> </Proxy> -> -> -> Redirect / /xwikiv2/ -> -> ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 -> ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 -> ProxyPreserveHost On -> </VirtualHost> -> -> So all communication should be encrypted and the user should -> immediately be redirected to the wiki. -> -> With these settings we encounter a strange behaviour. For example the -> Blog refuses to create a new category (see: [xwiki-users] Server not -> responding when creating a new Blog-Category). If I point my browser -> directly to my-domain.de:8080 I can create categories. -> -> Is the config file correct? Is there a better way? -> -> Cheers, -> Stephanie -> -> -> _______________________________________________ -> users mailing list -> [email protected] -> http://lists.xwiki.org/mailman/listinfo/users ->
Hi Guillaume, that results in the following error: Apr 18 15:35:27 jsvc.exec[823]: Apr 18, 2011 3:35:27 PM org.apache.jk.common.MsgAjp processHeader#012SEVERE: BAD packet signature 18245#012Apr 18, 2011 3:35:27 PM org.apache.jk.common.ChannelSocket processConnection#012SEVERE: Error, processing connection#012java.lang.IndexOutOfBoundsException#012#011at java.io.BufferedInputStream.read(BufferedInputStream.java:310)#012#011at org.apache.jk.common.ChannelSocket.read(ChannelSocket.java:627)#012#011at org.apache.jk.common.ChannelSocket.receive(ChannelSocket.java:584)#012#011at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:692)#012#011at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:897)#012#011at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689)#012#011at java.lang.Thread.run(Thread.java:662) Cheers, Stephanie Quoting Guillaume Fenollar <[email protected]>:
Hi Stephanie,
Can you try to replace the ProxyPass part by:
ProxyPass /xwikiv2 ajp://localhost:8009/xwikiv2<http://localhost:8080/xwikiv2>
ProxyPassReverse /xwikiv2 ajp://localhost:8009/xwikiv2<http://localhost:8080/xwikiv2>
Let me know if it's better. Regards,
Guillaume
2011/4/18 Paul Libbrecht <[email protected]>
Depending on the version you use, and how much you tuned it, using a different "context name" than /xwiki/ is likely to produce bizarre behaviours i believe.
Are you sure you need the <Proxy> section? Isn't that the door towards opening your server to be exploited as a proxy to go outside?
paul
Le 18 avr. 2011 à 13:28, [email protected] a écrit :
Redirect / /xwikiv2/
ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 ProxyPreserveHost On </VirtualHost>
So all communication should be encrypted and the user should immediately be redirected to the wiki.
With these settings we encounter a strange behaviour. For example the Blog refuses to create a new category (see: [xwiki-users] Server not responding when creating a new Blog-Category). If I point my browser directly to my-domain.de:8080 I can create categories.
Is the config file correct? Is there a better way?
_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
-- Guillaume Fenollar [email protected] Skype: guillaume.fenollar _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
Hello, does anyone know if I can setup Tomcat directly. Since there is no other content on that server, I actually do not need the Apache-Server. I guess all I have to do is: make tomcat listen on port 443. Make it accept ssl-connections and make the wiki the default application. But I have never done that, so if someone has experience in that field it would be nice if he7she could share them with me. Thanks a lot, Stephanie Quoting Sergiu Dumitriu <[email protected]>:
On 04/18/2011 01:28 PM, [email protected] wrote:
Hello again,
we are running a tomcat-server "behind" an apache-server. In order to redirect the request we use the following configuration:
<VirtualHost *:80> ServerName www.my-domain.de ServerAlias my-domain.de Redirect permanent / https://www.my-domain.de/ </VirtualHost>
<VirtualHost *:443> ServerName www.my-domain.de
SSLEngine On SSLProxyEngine On
SSLCertificateFile /etc/apache2/ssl/my-domain.crt SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key
<Proxy *> Order allow,deny Allow from all </Proxy>
Redirect / /xwikiv2/
ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 ProxyPreserveHost On </VirtualHost>
So all communication should be encrypted and the user should immediately be redirected to the wiki.
With these settings we encounter a strange behaviour. For example the Blog refuses to create a new category (see: [xwiki-users] Server not responding when creating a new Blog-Category). If I point my browser directly to my-domain.de:8080 I can create categories.
Is the config file correct? Is there a better way?
I think this is caused by the fact that the container (Tomcat) doesn't know the connection is secure (HTTPS) and tries to generate absolute URLs pointing to http instead of https. I don't know how to forward the information that the connection is secure from httpd to tomcat, but this could be a good starting point into fixing the problem.
-- Sergiu Dumitriu http://purl.org/net/sergiu/ _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
Hey, thanks it works now. At least I do not get any errors at the moment. Could you explain to me what the difference is? (HTTP vs. ajp) When proxying? @Everybody: Thank you for your help. Cheers, Chris Quoting "Kevin P. Foote" <[email protected]>:
Stephanie -
I use mod_jk for other reasons.. but mod_proxy_ajp is similar.. there is no reason why this should not work ..
Make some changes though..
In your httpd conf where you have your virtual host defined
change ServerName to the full address
ServerName https://www.my-domain.de
Dont proxy to tomcat via http... use tomcat in ajp mode .. disable port :8080 and server xwiki over :8009 only to local host via your <tomcat location>/conf/server.xml file. (usually all you need to do is comment the 8080 stuff and uncomment the 8009.
your proxy string will look something like this then..
ProxyPass /xwikiv2 ajp://localhost:8009/<xwiki instance>
------ thanks kevin.foote
On Mon, 18 Apr 2011, [email protected] wrote:
-> Hello again, -> -> we are running a tomcat-server "behind" an apache-server. In order to -> redirect the request we use the following configuration: -> -> <VirtualHost *:80> -> ServerName www.my-domain.de -> ServerAlias my-domain.de -> Redirect permanent / https://www.my-domain.de/ -> </VirtualHost> -> -> <VirtualHost *:443> -> ServerName www.my-domain.de -> -> SSLEngine On -> SSLProxyEngine On -> -> SSLCertificateFile /etc/apache2/ssl/my-domain.crt -> SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key -> -> <Proxy *> -> Order allow,deny -> Allow from all -> </Proxy> -> -> -> Redirect / /xwikiv2/ -> -> ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 -> ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 -> ProxyPreserveHost On -> </VirtualHost> -> -> So all communication should be encrypted and the user should -> immediately be redirected to the wiki. -> -> With these settings we encounter a strange behaviour. For example the -> Blog refuses to create a new category (see: [xwiki-users] Server not -> responding when creating a new Blog-Category). If I point my browser -> directly to my-domain.de:8080 I can create categories. -> -> Is the config file correct? Is there a better way? -> -> Cheers, -> Stephanie -> -> -> _______________________________________________ -> users mailing list -> [email protected] -> http://lists.xwiki.org/mailman/listinfo/users -> _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
Stephanie.. OK from your last post looks like some confusion.. so here goes: o Stop tomcat. o Backup your <tomcat location>/conf/server.xml file replace it with this one ... ---- SERVER.XML 8< ---- <?xml version="1.0" encoding="UTF-8"?> <Server port="8005" shutdown="SHUTDOWN"> <Service name="Catalina"> <Connector port="8009" address="127.0.0.1" URIEncoding="UTF-8" protocol="AJP/1.3" enableLookups="false" request.tomcatAuthentication="false" redirectPort="8443" scheme="https" proxyPort="443"/> <Engine name="Catalina" defaultHost="localhost"> <Host name="localhost" appBase="webapps" xmlValidation="false" xmlNamespaceAware="false"/> </Engine> </Service> </Server> ---- >8 END SERVER.XML ---- o start tomcat verify localhost is listening on 8009 o Inside your httpd conf where you have your virtual hosts defined.. replace -OUT- ServerName www.my-domain.de +IN+ ServerName https://www.my-domain.de -OUT- ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 +IN+ ProxyPass /xwikiv2 ajp://localhost:8009/xwikiv2 o restart httpd ------ thanks kevin.foote On Mon, 18 Apr 2011, Kevin P. Foote wrote: -> -> Stephanie - -> -> I use mod_jk for other reasons.. but mod_proxy_ajp is similar.. there is no -> reason why this should not work .. -> -> Make some changes though.. -> -> In your httpd conf where you have your virtual host defined -> -> change ServerName to the full address -> -> ServerName https://www.my-domain.de -> -> Dont proxy to tomcat via http... use tomcat in ajp mode .. -> disable port :8080 and server xwiki over :8009 only to local host via -> your <tomcat location>/conf/server.xml file. (usually all you need to do -> is comment the 8080 stuff and uncomment the 8009. -> -> your proxy string will look something like this then.. -> -> ProxyPass /xwikiv2 ajp://localhost:8009/<xwiki instance> -> -> -> ------ -> thanks -> kevin.foote -> -> On Mon, 18 Apr 2011, [email protected] wrote: -> -> -> Hello again, -> -> -> -> we are running a tomcat-server "behind" an apache-server. In order to -> -> redirect the request we use the following configuration: -> -> -> -> <VirtualHost *:80> -> -> ServerName www.my-domain.de -> -> ServerAlias my-domain.de -> -> Redirect permanent / https://www.my-domain.de/ -> -> </VirtualHost> -> -> -> -> <VirtualHost *:443> -> -> ServerName www.my-domain.de -> -> -> -> SSLEngine On -> -> SSLProxyEngine On -> -> -> -> SSLCertificateFile /etc/apache2/ssl/my-domain.crt -> -> SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key -> -> -> -> <Proxy *> -> -> Order allow,deny -> -> Allow from all -> -> </Proxy> -> -> -> -> -> -> Redirect / /xwikiv2/ -> -> -> -> ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 -> -> ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 -> -> ProxyPreserveHost On -> -> </VirtualHost> -> -> -> -> So all communication should be encrypted and the user should -> -> immediately be redirected to the wiki. -> -> -> -> With these settings we encounter a strange behaviour. For example the -> -> Blog refuses to create a new category (see: [xwiki-users] Server not -> -> responding when creating a new Blog-Category). If I point my browser -> -> directly to my-domain.de:8080 I can create categories. -> -> -> -> Is the config file correct? Is there a better way? -> -> -> -> Cheers, -> -> Stephanie -> -> -> -> -> -> _______________________________________________ -> -> users mailing list -> -> [email protected] -> -> http://lists.xwiki.org/mailman/listinfo/users -> -> -> _______________________________________________ -> users mailing list -> [email protected] -> http://lists.xwiki.org/mailman/listinfo/users ->
Hey Kevin, thanks it works now. What I do not understand, though is, why the apache-proxy (or xwiki) handles http request different to ajp requests. But maybe I just need to switch my brain on but right now it makes no sense to me... Thanks, Stephanie Quoting "Kevin P. Foote" <[email protected]>:
Stephanie..
OK from your last post looks like some confusion.. so here goes:
o Stop tomcat.
o Backup your <tomcat location>/conf/server.xml file replace it with this one ...
---- SERVER.XML 8< ---- <?xml version="1.0" encoding="UTF-8"?>
<Server port="8005" shutdown="SHUTDOWN">
<Service name="Catalina">
<Connector port="8009" address="127.0.0.1" URIEncoding="UTF-8" protocol="AJP/1.3" enableLookups="false" request.tomcatAuthentication="false" redirectPort="8443" scheme="https" proxyPort="443"/>
<Engine name="Catalina" defaultHost="localhost"> <Host name="localhost" appBase="webapps" xmlValidation="false" xmlNamespaceAware="false"/> </Engine>
</Service> </Server> ---- >8 END SERVER.XML ----
o start tomcat verify localhost is listening on 8009
o Inside your httpd conf where you have your virtual hosts defined.. replace
-OUT- ServerName www.my-domain.de +IN+ ServerName https://www.my-domain.de
-OUT- ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 +IN+ ProxyPass /xwikiv2 ajp://localhost:8009/xwikiv2
o restart httpd
------ thanks kevin.foote
On Mon, 18 Apr 2011, Kevin P. Foote wrote:
-> -> Stephanie - -> -> I use mod_jk for other reasons.. but mod_proxy_ajp is similar.. there is no -> reason why this should not work .. -> -> Make some changes though.. -> -> In your httpd conf where you have your virtual host defined -> -> change ServerName to the full address -> -> ServerName https://www.my-domain.de -> -> Dont proxy to tomcat via http... use tomcat in ajp mode .. -> disable port :8080 and server xwiki over :8009 only to local host via -> your <tomcat location>/conf/server.xml file. (usually all you need to do -> is comment the 8080 stuff and uncomment the 8009. -> -> your proxy string will look something like this then.. -> -> ProxyPass /xwikiv2 ajp://localhost:8009/<xwiki instance> -> -> -> ------ -> thanks -> kevin.foote -> -> On Mon, 18 Apr 2011, [email protected] wrote: -> -> -> Hello again, -> -> -> -> we are running a tomcat-server "behind" an apache-server. In order to -> -> redirect the request we use the following configuration: -> -> -> -> <VirtualHost *:80> -> -> ServerName www.my-domain.de -> -> ServerAlias my-domain.de -> -> Redirect permanent / https://www.my-domain.de/ -> -> </VirtualHost> -> -> -> -> <VirtualHost *:443> -> -> ServerName www.my-domain.de -> -> -> -> SSLEngine On -> -> SSLProxyEngine On -> -> -> -> SSLCertificateFile /etc/apache2/ssl/my-domain.crt -> -> SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key -> -> -> -> <Proxy *> -> -> Order allow,deny -> -> Allow from all -> -> </Proxy> -> -> -> -> -> -> Redirect / /xwikiv2/ -> -> -> -> ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 -> -> ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 -> -> ProxyPreserveHost On -> -> </VirtualHost> -> -> -> -> So all communication should be encrypted and the user should -> -> immediately be redirected to the wiki. -> -> -> -> With these settings we encounter a strange behaviour. For example the -> -> Blog refuses to create a new category (see: [xwiki-users] Server not -> -> responding when creating a new Blog-Category). If I point my browser -> -> directly to my-domain.de:8080 I can create categories. -> -> -> -> Is the config file correct? Is there a better way? -> -> -> -> Cheers, -> -> Stephanie -> -> -> -> -> -> _______________________________________________ -> -> users mailing list -> -> [email protected] -> -> http://lists.xwiki.org/mailman/listinfo/users -> -> -> _______________________________________________ -> users mailing list -> [email protected] -> http://lists.xwiki.org/mailman/listinfo/users -> _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
Web server talks binary to ajp .. rather than text (http). Purely performance.. There is no magic in the setup and xwiki is not doing anything it would not do if served straight from tomcat. Since you've eliminated the 8080 port and your only listing on 127.0.0.1 now your less prone to that attack vector.. (your webserver is talking locally to tomcat and tomcat is only listening locally for connections) ------ thanks kevin.foote On Mon, 18 Apr 2011, [email protected] wrote: -> Hey Kevin, -> -> thanks it works now. -> What I do not understand, though is, why the apache-proxy (or xwiki) -> handles http request different to ajp requests. But maybe I just need -> to switch my brain on but right now it makes no sense to me... -> -> Thanks, -> Stephanie -> -> -> -> Quoting "Kevin P. Foote" <[email protected]>: -> -> > -> > Stephanie.. -> > -> > OK from your last post looks like some confusion.. so here goes: -> > -> > o Stop tomcat. -> > -> > o Backup your <tomcat location>/conf/server.xml file replace it with this -> > one ... -> > -> > -> > ---- SERVER.XML 8< ---- -> > <?xml version="1.0" encoding="UTF-8"?> -> > -> > <Server port="8005" shutdown="SHUTDOWN"> -> > -> > <Service name="Catalina"> -> > -> > <Connector port="8009" -> > address="127.0.0.1" -> > URIEncoding="UTF-8" -> > protocol="AJP/1.3" -> > enableLookups="false" -> > request.tomcatAuthentication="false" -> > redirectPort="8443" -> > scheme="https" -> > proxyPort="443"/> -> > -> > <Engine name="Catalina" defaultHost="localhost"> -> > <Host name="localhost" appBase="webapps" xmlValidation="false" -> > xmlNamespaceAware="false"/> -> > </Engine> -> > -> > </Service> -> > </Server> -> > ---- >8 END SERVER.XML ---- -> > -> > o start tomcat verify localhost is listening on 8009 -> > -> > o Inside your httpd conf where you have your virtual hosts defined.. -> > replace -> > -> > -OUT- ServerName www.my-domain.de -> > +IN+ ServerName https://www.my-domain.de -> > -> > -OUT- ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 -> > +IN+ ProxyPass /xwikiv2 ajp://localhost:8009/xwikiv2 -> > -> > o restart httpd -> > -> > -> > -> > -> > -> > -> > ------ -> > thanks -> > kevin.foote -> > -> > On Mon, 18 Apr 2011, Kevin P. Foote wrote: -> > -> > -> -> > -> Stephanie - -> > -> -> > -> I use mod_jk for other reasons.. but mod_proxy_ajp is similar.. -> > there is no -> > -> reason why this should not work .. -> > -> -> > -> Make some changes though.. -> > -> -> > -> In your httpd conf where you have your virtual host defined -> > -> -> > -> change ServerName to the full address -> > -> -> > -> ServerName https://www.my-domain.de -> > -> -> > -> Dont proxy to tomcat via http... use tomcat in ajp mode .. -> > -> disable port :8080 and server xwiki over :8009 only to local host via -> > -> your <tomcat location>/conf/server.xml file. (usually all you need to do -> > -> is comment the 8080 stuff and uncomment the 8009. -> > -> -> > -> your proxy string will look something like this then.. -> > -> -> > -> ProxyPass /xwikiv2 ajp://localhost:8009/<xwiki instance> -> > -> -> > -> -> > -> ------ -> > -> thanks -> > -> kevin.foote -> > -> -> > -> On Mon, 18 Apr 2011, [email protected] wrote: -> > -> -> > -> -> Hello again, -> > -> -> -> > -> -> we are running a tomcat-server "behind" an apache-server. In order to -> > -> -> redirect the request we use the following configuration: -> > -> -> -> > -> -> <VirtualHost *:80> -> > -> -> ServerName www.my-domain.de -> > -> -> ServerAlias my-domain.de -> > -> -> Redirect permanent / https://www.my-domain.de/ -> > -> -> </VirtualHost> -> > -> -> -> > -> -> <VirtualHost *:443> -> > -> -> ServerName www.my-domain.de -> > -> -> -> > -> -> SSLEngine On -> > -> -> SSLProxyEngine On -> > -> -> -> > -> -> SSLCertificateFile /etc/apache2/ssl/my-domain.crt -> > -> -> SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key -> > -> -> -> > -> -> <Proxy *> -> > -> -> Order allow,deny -> > -> -> Allow from all -> > -> -> </Proxy> -> > -> -> -> > -> -> -> > -> -> Redirect / /xwikiv2/ -> > -> -> -> > -> -> ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 -> > -> -> ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 -> > -> -> ProxyPreserveHost On -> > -> -> </VirtualHost> -> > -> -> -> > -> -> So all communication should be encrypted and the user should -> > -> -> immediately be redirected to the wiki. -> > -> -> -> > -> -> With these settings we encounter a strange behaviour. For example the -> > -> -> Blog refuses to create a new category (see: [xwiki-users] Server not -> > -> -> responding when creating a new Blog-Category). If I point my browser -> > -> -> directly to my-domain.de:8080 I can create categories. -> > -> -> -> > -> -> Is the config file correct? Is there a better way? -> > -> -> -> > -> -> Cheers, -> > -> -> Stephanie -> > -> -> -> > -> -> -> > -> -> _______________________________________________ -> > -> -> users mailing list -> > -> -> [email protected] -> > -> -> http://lists.xwiki.org/mailman/listinfo/users -> > -> -> -> > -> _______________________________________________ -> > -> users mailing list -> > -> [email protected] -> > -> http://lists.xwiki.org/mailman/listinfo/users -> > -> -> > _______________________________________________ -> > users mailing list -> > [email protected] -> > http://lists.xwiki.org/mailman/listinfo/users -> > -> -> -> _______________________________________________ -> users mailing list -> [email protected] -> http://lists.xwiki.org/mailman/listinfo/users ->
On 04/18/2011 03:52 PM, [email protected] wrote:
Hey,
thanks it works now. At least I do not get any errors at the moment. Could you explain to me what the difference is? (HTTP vs. ajp) When proxying?
ajp is a direct connection between httpd and tomcat, which basically lets Tomcat take care of a request on behalf of httpd. The request details are kept in place, including the hostname, the port, whether the connection is secure (SSL/https) or not... HTTP proxying means that httpd clones the initial client request as a new http request to the Tomcat server. Thus, unless specifically configured to try and pass some details from the initial request, Tomcat will just see this as an ordinary request done to "localhost" on port 8080. ProxyPass, ProxyPassReverse and ProxyPreserveHost try to keep the same hostname (www.my-domain.de instead of localhost), but don't keep the fact that HTTPS was used. The problem with the blog is that unlike most parts of the wiki, absolute URLs are used when creating a new category. This means that a full URL, trying to match the requested URL, is computed. Now, since Tomcat/XWiki doesn't really know the original URL, the generated URL will be most likely wrong, pointing to the wrong host and port.
@Everybody: Thank you for your help.
Cheers, Chris
Quoting "Kevin P. Foote"<[email protected]>:
Stephanie -
I use mod_jk for other reasons.. but mod_proxy_ajp is similar.. there is no reason why this should not work ..
Make some changes though..
In your httpd conf where you have your virtual host defined
change ServerName to the full address
ServerName https://www.my-domain.de
Dont proxy to tomcat via http... use tomcat in ajp mode .. disable port :8080 and server xwiki over :8009 only to local host via your<tomcat location>/conf/server.xml file. (usually all you need to do is comment the 8080 stuff and uncomment the 8009.
your proxy string will look something like this then..
ProxyPass /xwikiv2 ajp://localhost:8009/<xwiki instance>
------ thanks kevin.foote
On Mon, 18 Apr 2011, [email protected] wrote:
-> Hello again, -> -> we are running a tomcat-server "behind" an apache-server. In order to -> redirect the request we use the following configuration: -> -> <VirtualHost *:80> -> ServerName www.my-domain.de -> ServerAlias my-domain.de -> Redirect permanent / https://www.my-domain.de/ -> </VirtualHost> -> -> <VirtualHost *:443> -> ServerName www.my-domain.de -> -> SSLEngine On -> SSLProxyEngine On -> -> SSLCertificateFile /etc/apache2/ssl/my-domain.crt -> SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key -> -> <Proxy *> -> Order allow,deny -> Allow from all -> </Proxy> -> -> -> Redirect / /xwikiv2/ -> -> ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 -> ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 -> ProxyPreserveHost On -> </VirtualHost> -> -> So all communication should be encrypted and the user should -> immediately be redirected to the wiki. -> -> With these settings we encounter a strange behaviour. For example the -> Blog refuses to create a new category (see: [xwiki-users] Server not -> responding when creating a new Blog-Category). If I point my browser -> directly to my-domain.de:8080 I can create categories. -> -> Is the config file correct? Is there a better way? -> -> Cheers, -> Stephanie
-- Sergiu Dumitriu http://purl.org/net/sergiu/
Am 19.04.2011 00:08, schrieb Sergiu Dumitriu:
On 04/18/2011 03:52 PM, [email protected] wrote:
Hey,
thanks it works now. At least I do not get any errors at the moment. Could you explain to me what the difference is? (HTTP vs. ajp) When proxying? ajp is a direct connection between httpd and tomcat, which basically lets Tomcat take care of a request on behalf of httpd. The request details are kept in place, including the hostname, the port, whether the connection is secure (SSL/https) or not...
HTTP proxying means that httpd clones the initial client request as a new http request to the Tomcat server. Thus, unless specifically configured to try and pass some details from the initial request, Tomcat will just see this as an ordinary request done to "localhost" on port 8080.
ProxyPass, ProxyPassReverse and ProxyPreserveHost try to keep the same hostname (www.my-domain.de instead of localhost), but don't keep the fact that HTTPS was used.
Thanks for the backgrounder !
The problem with the blog is that unlike most parts of the wiki, absolute URLs are used when creating a new category. This means that a full URL, trying to match the requested URL, is computed. Now, since Tomcat/XWiki doesn't really know the original URL, the generated URL will be most likely wrong, pointing to the wrong host and port.
Couldn't that / shouldn't that be changed so that its possible to reliably operate XWiki with all of its features behind a httpd ? I think a lot of people are doing that (including me). Never tried blogging though .... Are other parts of XWiki also affected by this 'wrong' computation of the url ? kind regards Andreas
@Everybody: Thank you for your help.
Cheers, Chris
Quoting "Kevin P. Foote"<[email protected]>:
Stephanie -
I use mod_jk for other reasons.. but mod_proxy_ajp is similar.. there is no reason why this should not work ..
Make some changes though..
In your httpd conf where you have your virtual host defined
change ServerName to the full address
ServerName https://www.my-domain.de
Dont proxy to tomcat via http... use tomcat in ajp mode .. disable port :8080 and server xwiki over :8009 only to local host via your<tomcat location>/conf/server.xml file. (usually all you need to do is comment the 8080 stuff and uncomment the 8009.
your proxy string will look something like this then..
ProxyPass /xwikiv2 ajp://localhost:8009/<xwiki instance>
------ thanks kevin.foote
On Mon, 18 Apr 2011, [email protected] wrote:
-> Hello again, -> -> we are running a tomcat-server "behind" an apache-server. In order to -> redirect the request we use the following configuration: -> -> <VirtualHost *:80> -> ServerName www.my-domain.de -> ServerAlias my-domain.de -> Redirect permanent / https://www.my-domain.de/ -> </VirtualHost> -> -> <VirtualHost *:443> -> ServerName www.my-domain.de -> -> SSLEngine On -> SSLProxyEngine On -> -> SSLCertificateFile /etc/apache2/ssl/my-domain.crt -> SSLCertificateKeyFile /etc/apache2/ssl/my-domain.key -> -> <Proxy *> -> Order allow,deny -> Allow from all -> </Proxy> -> -> -> Redirect / /xwikiv2/ -> -> ProxyPass /xwikiv2 http://localhost:8080/xwikiv2 -> ProxyPassReverse /xwikiv2 http://localhost:8080/xwikiv2 -> ProxyPreserveHost On -> </VirtualHost> -> -> So all communication should be encrypted and the user should -> immediately be redirected to the wiki. -> -> With these settings we encounter a strange behaviour. For example the -> Blog refuses to create a new category (see: [xwiki-users] Server not -> responding when creating a new Blog-Category). If I point my browser -> directly to my-domain.de:8080 I can create categories. -> -> Is the config file correct? Is there a better way? -> -> Cheers, -> Stephanie
On 04/19/2011 09:09 AM, Andreas Hahn wrote:
Am 19.04.2011 00:08, schrieb Sergiu Dumitriu:
On 04/18/2011 03:52 PM, [email protected] wrote:
Hey,
thanks it works now. At least I do not get any errors at the moment. Could you explain to me what the difference is? (HTTP vs. ajp) When proxying? ajp is a direct connection between httpd and tomcat, which basically lets Tomcat take care of a request on behalf of httpd. The request details are kept in place, including the hostname, the port, whether the connection is secure (SSL/https) or not...
HTTP proxying means that httpd clones the initial client request as a new http request to the Tomcat server. Thus, unless specifically configured to try and pass some details from the initial request, Tomcat will just see this as an ordinary request done to "localhost" on port 8080.
ProxyPass, ProxyPassReverse and ProxyPreserveHost try to keep the same hostname (www.my-domain.de instead of localhost), but don't keep the fact that HTTPS was used.
Thanks for the backgrounder !
The problem with the blog is that unlike most parts of the wiki, absolute URLs are used when creating a new category. This means that a full URL, trying to match the requested URL, is computed. Now, since Tomcat/XWiki doesn't really know the original URL, the generated URL will be most likely wrong, pointing to the wrong host and port.
Couldn't that / shouldn't that be changed so that its possible to reliably operate XWiki with all of its features behind a httpd ?
It does work, if the configuration is correct.
I think a lot of people are doing that (including me). Never tried blogging though .... Are other parts of XWiki also affected by this 'wrong' computation of the url ?
-- Sergiu Dumitriu http://purl.org/net/sergiu/
Am 19.04.2011 15:41, schrieb Sergiu Dumitriu:
On 04/19/2011 09:09 AM, Andreas Hahn wrote:
Am 19.04.2011 00:08, schrieb Sergiu Dumitriu:
On 04/18/2011 03:52 PM, [email protected] wrote:
Hey,
thanks it works now. At least I do not get any errors at the moment. Could you explain to me what the difference is? (HTTP vs. ajp) When proxying? ajp is a direct connection between httpd and tomcat, which basically lets Tomcat take care of a request on behalf of httpd. The request details are kept in place, including the hostname, the port, whether the connection is secure (SSL/https) or not...
HTTP proxying means that httpd clones the initial client request as a new http request to the Tomcat server. Thus, unless specifically configured to try and pass some details from the initial request, Tomcat will just see this as an ordinary request done to "localhost" on port 8080.
ProxyPass, ProxyPassReverse and ProxyPreserveHost try to keep the same hostname (www.my-domain.de instead of localhost), but don't keep the fact that HTTPS was used. Thanks for the backgrounder !
The problem with the blog is that unlike most parts of the wiki, absolute URLs are used when creating a new category. This means that a full URL, trying to match the requested URL, is computed. Now, since Tomcat/XWiki doesn't really know the original URL, the generated URL will be most likely wrong, pointing to the wrong host and port. Couldn't that / shouldn't that be changed so that its possible to reliably operate XWiki with all of its features behind a httpd ? It does work, if the configuration is correct.
I see. I just checked with my installation that Blog works ok. If I understand correctly that has to do with the fact that I'm just using simple HTTP proxying (and not HTTPS, in this case ajp should be used).
I think a lot of people are doing that (including me). Never tried blogging though .... Are other parts of XWiki also affected by this 'wrong' computation of the url ?
Andreas If your intercepting with anything (httpd,nginx,lighttpd), thus proxying, you should use ajp. Its simply faster.. ------ thanks kevin.foote On Tue, 19 Apr 2011, Andreas Hahn wrote: -> Am 19.04.2011 15:41, schrieb Sergiu Dumitriu: -> > On 04/19/2011 09:09 AM, Andreas Hahn wrote: -> >> Am 19.04.2011 00:08, schrieb Sergiu Dumitriu: -> >>> On 04/18/2011 03:52 PM, [email protected] wrote: -> >>>> Hey, -> >>>> -> >>>> thanks it works now. At least I do not get any errors at the moment. -> >>>> Could you explain to me what the difference is? (HTTP vs. ajp) When proxying? -> >>> ajp is a direct connection between httpd and tomcat, which basically -> >>> lets Tomcat take care of a request on behalf of httpd. The request -> >>> details are kept in place, including the hostname, the port, whether the -> >>> connection is secure (SSL/https) or not... -> >>> -> >>> HTTP proxying means that httpd clones the initial client request as a -> >>> new http request to the Tomcat server. Thus, unless specifically -> >>> configured to try and pass some details from the initial request, Tomcat -> >>> will just see this as an ordinary request done to "localhost" on port 8080. -> >>> -> >>> ProxyPass, ProxyPassReverse and ProxyPreserveHost try to keep the same -> >>> hostname (www.my-domain.de instead of localhost), but don't keep the -> >>> fact that HTTPS was used. -> >> Thanks for the backgrounder ! -> >> -> >>> The problem with the blog is that unlike most parts of the wiki, -> >>> absolute URLs are used when creating a new category. This means that a -> >>> full URL, trying to match the requested URL, is computed. Now, since -> >>> Tomcat/XWiki doesn't really know the original URL, the generated URL -> >>> will be most likely wrong, pointing to the wrong host and port. -> >> Couldn't that / shouldn't that be changed so that its possible to -> >> reliably operate -> >> XWiki with all of its features behind a httpd ? -> > It does work, if the configuration is correct. -> -> I see. I just checked with my installation that Blog works ok. If I -> understand correctly -> that has to do with the fact that I'm just using simple HTTP proxying -> (and not HTTPS, -> in this case ajp should be used). -> -> -> >> I think a lot of people are doing that (including me). Never tried -> >> blogging though .... -> >> Are other parts of XWiki also affected by this 'wrong' computation of -> >> the url ? -> >> -> > -> -> _______________________________________________ -> users mailing list -> [email protected] -> http://lists.xwiki.org/mailman/listinfo/users ->
Am 19.04.2011 17:07, schrieb Kevin P. Foote:
Andreas
If your intercepting with anything (httpd,nginx,lighttpd), thus proxying, you should use ajp. Its simply faster..
thanks Kevin, I'll check that out soon ...
------ thanks kevin.foote
On Tue, 19 Apr 2011, Andreas Hahn wrote:
-> Am 19.04.2011 15:41, schrieb Sergiu Dumitriu: -> > On 04/19/2011 09:09 AM, Andreas Hahn wrote: -> >> Am 19.04.2011 00:08, schrieb Sergiu Dumitriu: -> >>> On 04/18/2011 03:52 PM, [email protected] wrote: -> >>>> Hey, -> >>>> -> >>>> thanks it works now. At least I do not get any errors at the moment. -> >>>> Could you explain to me what the difference is? (HTTP vs. ajp) When proxying? -> >>> ajp is a direct connection between httpd and tomcat, which basically -> >>> lets Tomcat take care of a request on behalf of httpd. The request -> >>> details are kept in place, including the hostname, the port, whether the -> >>> connection is secure (SSL/https) or not... -> >>> -> >>> HTTP proxying means that httpd clones the initial client request as a -> >>> new http request to the Tomcat server. Thus, unless specifically -> >>> configured to try and pass some details from the initial request, Tomcat -> >>> will just see this as an ordinary request done to "localhost" on port 8080. -> >>> -> >>> ProxyPass, ProxyPassReverse and ProxyPreserveHost try to keep the same -> >>> hostname (www.my-domain.de instead of localhost), but don't keep the -> >>> fact that HTTPS was used. -> >> Thanks for the backgrounder ! -> >> -> >>> The problem with the blog is that unlike most parts of the wiki, -> >>> absolute URLs are used when creating a new category. This means that a -> >>> full URL, trying to match the requested URL, is computed. Now, since -> >>> Tomcat/XWiki doesn't really know the original URL, the generated URL -> >>> will be most likely wrong, pointing to the wrong host and port. -> >> Couldn't that / shouldn't that be changed so that its possible to -> >> reliably operate -> >> XWiki with all of its features behind a httpd ? -> > It does work, if the configuration is correct. -> -> I see. I just checked with my installation that Blog works ok. If I -> understand correctly -> that has to do with the fact that I'm just using simple HTTP proxying -> (and not HTTPS, -> in this case ajp should be used). -> -> -> >> I think a lot of people are doing that (including me). Never tried -> >> blogging though .... -> >> Are other parts of XWiki also affected by this 'wrong' computation of -> >> the url ? -> >> -> > -> -> _______________________________________________ -> users mailing list -> [email protected] -> http://lists.xwiki.org/mailman/listinfo/users -> _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users
participants (6)
-
Andreas Hahn -
Guillaume Fenollar -
Kevin P. Foote -
lists＠yhmail.de -
Paul Libbrecht -
Sergiu Dumitriu