@Jose, No, I am using simple reverse proxy with HTTPS Apache as front end, and back-end also its communicating via HTTPS, so end to end its encrypted.
here are my few lines of apache config ProxyPreserveHost On ProxyPass / https://localhost:9443/ ProxyPassReverse / https://localhost:9443/ Header always set Content-Security-Policy: upgrade-insecure-requests #ignore SSL verify for https proxy IP SSLProxyEngine on SSLProxyVerify none SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off <Location /cas/adminlogin> order Deny,Allow Deny from all </Location> On Friday, June 19, 2020 at 4:35:38 PM UTC+5:30, José Ramón Martín Magdalena wrote: > > Hi Root, > > Thanks for your reply. Nop, I'm going to try. I'm wondering, the login CAS > page don't warn you about the non-secure connection? > > News in a while. > > El viernes, 19 de junio de 2020, 11:30:27 (UTC+1), Root escribió: >> >> @Jose >> Did you try without AJP ?, for me it works with apache with below cas >> settings >> >> >> cas.server.http.enabled=false >> cas.server.httpProxy.enabled=true >> cas.server.httpProxy.secure=true >> cas.server.httpProxy.scheme=https >> cas.server.httpProxy.protocol=HTTP/1.1 >> >> >> >> On Friday, June 19, 2020 at 2:48:38 PM UTC+5:30, José Ramón Martín >> Magdalena wrote: >>> >>> Hello guys, >>> >>> It looked promising, right! But no, exactly the same result. >>> Frustrating. >>> Any ideas? >>> >>> >>> El viernes, 19 de junio de 2020, 9:42:50 (UTC+1), José Ramón Martín >>> Magdalena escribió: >>>> >>>> Hi King, >>>> >>>> First of all, thank you for your quick reply. I tried your solution >>>> unfortunately without success. Having a look at the Tomcat >>>> documentation >>>> <http://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html#Standard_Implementations> >>>> I >>>> found that the correct attribute name is 'secret' so I decided to try with >>>> : >>>> >>>> cas.server.tomcat.ajp.attributes.secretRequired=true >>>> cas.server.tomcat.ajp.attributes.secret=TheSecret >>>> >>>> But same result. Now I'm moved to the AJP CAS Properties >>>> <https://apereo.github.io/cas/6.1.x/configuration/Configuration-Properties.html#ajp> >>>> and >>>> right now I'm trying >>>> >>>> cas.server.tomcat.ajp.enabled=true >>>> >>>> >>>> Finger crossing. >>>> >>>> >>>> >>>> >>>> El jueves, 18 de junio de 2020, 21:26:49 (UTC+1), Kink escribió: >>>>> >>>>> Hi José, >>>>> >>>>> Since Tomcat 9.03x and AJP v1.3, if I am correct, the AJP connector >>>>> needs to have the Secret declared in it as in here: >>>>> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" >>>>> requiredSecret="myComplexKeyComesHereButIHaveNotUsedItElseWhere" >>>>> secretRequired="true"> >>>>> >>>>> Could it be that you should simply replace >>>>> cas.server.tomcat.ajp.attributes.secret = isasecret >>>>> with >>>>> cas.server.tomcat.ajp.attributes.requiredSecret = isasecret >>>>> >>>>> I was in the same position last year: new to Docker, Overlays, CAS, >>>>> ApacheDS, and more... a tough year! >>>>> CAS really is great but with such a hard learning curve, this is >>>>> insane LOL but a lot of good and knowledgeable (not me!) guys hang around >>>>> here :-) >>>>> >>>>> Good luck >>>>> Kink >>>>> >>>>> On Thu, Jun 18, 2020 at 5:32 PM José Ramón Martín Magdalena < >>>>> [email protected]> wrote: >>>>> >>>>>> Good afternoon group, >>>>>> >>>>>> I have been for some time, more than desired being honest, trying to >>>>>> deploy a CAS server in my organization on a cluster Kubernetes and I >>>>>> think >>>>>> I have almost succeeded. >>>>>> >>>>>> The truth is that if I had previously known how difficult it has >>>>>> been, I will not get on the boat. Previously, I had never worked with >>>>>> Docker, Kubernetes, or CAS. The upside is that my confinement has not >>>>>> been >>>>>> boring. >>>>>> >>>>>> I am currently trying to publish the service abroad using reverse >>>>>> apache proxy but the container dies returning the following error: >>>>>> >>>>>> *The AJP Connector is configured with secretRequired = "true" but the >>>>>> secret attribute is either null or "". This combination is not valid.* >>>>>> >>>>>> The configuration that I have included for proxy in cas.properties is >>>>>> the following: >>>>>> >>>>>> ## config for proxy >>>>>> server.port = 8080 >>>>>> server.ssl.enabled = false >>>>>> cas.server.tomcat.http.enabled = false >>>>>> cas.server.tomcat.httpProxy.enabled = true >>>>>> cas.server.tomcat.httpProxy.secure = true >>>>>> cas.server.tomcat.httpProxy.scheme = https >>>>>> cas.server.tomcat.ajp.attributes.secret = isasecret << I thought this >>>>>> would solve the problem but no. >>>>>> >>>>>> Could someone tell me, for heaven's sake, where is the fault? >>>>>> >>>>>> Thanks in advance for your contribution. >>>>>> >>>>>> Regards. >>>>>> >>>>>> -- >>>>>> - Website: https://apereo.github.io/cas >>>>>> - Gitter Chatroom: https://gitter.im/apereo/cas >>>>>> - List Guidelines: https://goo.gl/1VRrw7 >>>>>> - Contributions: https://goo.gl/mh7qDG >>>>>> --- >>>>>> You received this message because you are subscribed to the Google >>>>>> Groups "CAS Community" group. >>>>>> To unsubscribe from this group and stop receiving emails from it, >>>>>> send an email to [email protected]. >>>>>> To view this discussion on the web visit >>>>>> https://groups.google.com/a/apereo.org/d/msgid/cas-user/8ef35652-960b-402d-b65b-716710d1dee8o%40apereo.org >>>>>> >>>>>> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/8ef35652-960b-402d-b65b-716710d1dee8o%40apereo.org?utm_medium=email&utm_source=footer> >>>>>> . >>>>>> >>>>> -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/750fb2da-bbd9-420b-b850-7879e9e99f89o%40apereo.org.
