[#AMATH-517] Apache mod_proxy should be supported

ActiveMath

Apache mod_proxy should be supported

Created: 2005-04-18 14:04 Updated: 2006-11-09 12:11

Component/s:

Webapp

Affects Version/s:

1.0b2

Fix Version/s:

1.0

Time Tracking:

Not Specified

Description

« Hide

Apache mod_proxy is the standard tool used to provide a facade server which relays requests to back-engines inside a firewall.

Currently, authentication seems at a great problem using mod_proxy as can be tested in http://leam-calculus.activemath.org/ which is a proxy to http://analysis.activemath.org:58080/

From experimental observation I could only observer that the cookies used in the security framework keep getting lost (even with a telnet!). I have tried to have looks inside the source but could not get along and should spend time at other places.
We need to sit someone to investigate.

thanks

paul

All

Comments

Work Log

Change History

Version Control

FishEye

Crucible

Related Builds

Sort Order:

Ascending order - Click to sort in descending order

[ Permlink | « Hide ]

Stefan Winterstein - 2005-05-02 15:05

This problem boiled down to a wrongly set server time, so the cookies were invalid.

[ Permlink | « Hide ]

Paul Libbrecht - 2005-05-02 15:05

That was the problem we had... namely that some authentication was wrong.
mod_proxy support isn't complete yet, though !

Among others:

we use host-absolute paths which prevents proxying from hostName/ to hostName/ActiveMath2
we sometimes need to return absolute URLs, including hostnames (for example, in PDF) but that would be wrong in the current usage... we would return the URL of the back-end machine where one would wish the URL of (foremost) proxy.

paul

[ Permlink | « Hide ]

Paul Libbrecht - 2005-07-02 23:07

Here is a situation where, clearly, we cannot devise our hostname whatsoever except from a configuration:

In the browser-delegation scenario, the guide-server should call the activity-server (Siette for now) and give it the URL of the ActiveMath (namely, the URL-to-return-the-result-to).

In the current escaping we have done, there seems to be a way to use proxy-added HTTP headers to detect which host called us.
In the delegation case this has chances to fail: if the client's browser is using one way of calling the AM-server (e.g. a local address) whereas the activity-server should use a public one (e.g. a proxied address).

I think we have no way to escape a fixed configuration that gives the URL.
Jira does this, btw.

paul

[ Permlink | « Hide ]

Paul Libbrecht - 2005-07-02 23:07

Have just inserted a method Manager.getAdvertizedLocalhostName
with a property advertizedLocalhost which, if set, is used.
If the property is not set (or is empty or whitespace), the localhost provided by InetAddress is used (it is known to fail in several offline linux laptops).

paul

[ Permlink | « Hide ]

Stefan Winterstein - 2005-10-20 13:10

Can we close this? If not, what's still missing?

[ Permlink | « Hide ]

Paul Libbrecht - 2005-10-20 14:10

We still have not solved the problem that only virtual-hosts can be proxied.
I do think it is wishable, though not urgent, that we either use:

getAdvertizedUrl to output absolute URLs
or use relative URLs
That is, we should avoid using host-absolute URLs as is currently defined $appRoot.

Maybe defining appRoot to be the advertized URL if it is explicitly defined is a very wise way.

Is the topic of the remote-host-name-to-be-not-the-proxy solved ?

paul

[ Permlink | « Hide ]

Stefan Winterstein - 2006-03-31 15:03

The current behavior is:

$appRoot - /ActiveMath2
$hosturl - Manager.getAdvertizedUrl(), eg. "http://leam-calculus.activemath.org/ActiveMath2"

In the Velocity files, only $appRoot is used.

> Maybe defining appRoot to be the advertized URL if it is explicitly defined is a very wise way.

I can do that, sounds okay.

>Is the topic of the remote-host-name-to-be-not-the-proxy solved ?

Please explain.

[ Permlink | « Hide ]

Stefan Winterstein - 2006-11-09 12:11

Proxy deployment is fine by now.