# HAProxy with Dex issue

**URL:** <https://discourse.openondemand.org/t/haproxy-with-dex-issue/1844>\
**Category:** Get Help\
**Created:** [December 16, 2021, 1:16pm UTC](https://discourse.openondemand.org/t/haproxy-with-dex-issue/1844 "2021-12-16T13:16:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hadjigc](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/hadjigc/32/936_2.png) [@hadjigc](https://discourse.openondemand.org/u/hadjigc)\
**Post date:** [December 16, 2021, 1:16pm UTC](https://discourse.openondemand.org/t/haproxy-with-dex-issue/1844/1 "2021-12-16T13:16:25Z")

</div>

Hi,

I’ve been trying to get OnDemand 2.0.20 with Dex to work with HAProxy by following this thread [Putting an entire OOD setup behind a web proxy? - #5 by wdpypere](https://discourse.openondemand.org/t/putting-an-entire-ood-setup-behind-a-web-proxy/519/5)  
The proxy is [ondemand.example.org](http://ondemand.example.org) and ondemand is [ondemand000.example.org](http://ondemand000.example.org)

At the moment I’m getting the following error(fqdn domain changed):

> oidc\_util\_http\_call: curl\_easy\_perform() failed on: [https://o](https://o)  
> [ndemand.example.org:5554/.well-known/openid-configuration](http://ndemand.example.org:5554/.well-known/openid-configuration) (Failed connect to \<ondemand000\_ip\>:5554; Connection refused)  
> [Thu Dec 16 11:46:21.434240 2021] [auth\_openidc:error] [pid 5028] [client \<haproxy\_ip\>:57804] oidc\_provider\_static\_config: could not retrieve metadata from  
> url: [https://ondemand.example.org:5554/.well-known/openid-configuration](https://ondemand.example.org:5554/.well-known/openid-configuration)

The ood\_portal.yml has the following relevant information:

> servername: [ondemand000.example.org](http://ondemand000.example.org)  
> proxy\_server: [ondemand.example.org](http://ondemand.example.org)  
> ssl:
> 
> - ‘SSLCertificateFile “/etc/pki/tls/certs/ondemand000-example-org-chain.pem”’
> - ‘SSLCertificateKeyFile “/etc/pki/tls/private/ondemand000.key”’
> - ‘SSLCertificateChainFile “/etc/pki/tls/certs/ondemand000-example-org-chain.pem”’
> 
> auth:
> 
> - ‘AuthType openid-connect’
> - ‘Require valid-user’
> 
> dex:  
> ssl: true  
> connectors:  
> - type: ldap  
> id: ldap  
> name: LDAP  
> config:  
> ----redacted config
> 
> logout\_redirect: /oidc?logout=https%3A%2F%[2Fondemand.example.org](http://2Fondemand.example.org)

The haproxy config:\>

> frontend main  
> bind \*:80  
> bind \<haproxy\_ip\>:443 crt /etc/pki/tls/certs/ondemand\_example\_org.pem ssl  
> default\_backend app  
> mode http  
> stats uri /haproxy?stats
> 
> backend app  
> balance roundrobin  
> mode http  
> timeout tunnel 7200s  
> option forwardfor  
> http-request redirect scheme https unless { ssl\_fc }  
> server ondemand000 \<ondemand000\_ip\>:443 check ssl verify none

Also set the following in `/opt/rh/httpd24/root/etc/httpd/conf.d/auth_openidc.conf`:

> OIDCRedirectURI [https://ondemand.example.org/oidc](https://ondemand.example.org/oidc)

I’ve tried setting a separate frontend and backend in haproxy for Dex(port 5554) and the message then changes to:

> oidc\_authenticate\_user: the URL hostname ([ondemand000.example.org](http://ondemand000.example.org)) of the configured OIDCRedirectURI does not match the URL hostname of the URL being accessed ([ondemand.example.org](http://ondemand.example.org)): the “state” and “session” cookies will not be shared between the two!

We also have an OnDemand 1.7 server which works fine with haproxy but that doesn’t have Dex and the hostname is the same as the haproxy([ondemand.example.org](http://ondemand.example.org)), if that makes a difference. The HAProxy is version 1.8.

Any ideas or help is appreciated.

Thanks,  
Chris

---

<div class="post-metadata">

**Author:** ![wdpypere](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/wdpypere/32/224_2.png) [@wdpypere](https://discourse.openondemand.org/u/wdpypere)\
**Post date:** [December 16, 2021, 2:10pm UTC](https://discourse.openondemand.org/t/haproxy-with-dex-issue/1844/2 "2021-12-16T14:10:25Z")

</div>

Hi Chris,

I haven’t looked into it specifically but could it be that your problem is the same as in: [field "issuer" in generated dex config should be configurable · Issue #1101 · OSC/ondemand · GitHub](https://github.com/OSC/ondemand/issues/1101) ?

Regards,

Wouter

---

<div class="post-metadata">

**Author:** ![hadjigc](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/hadjigc/32/936_2.png) [@hadjigc](https://discourse.openondemand.org/u/hadjigc)\
**Post date:** [December 16, 2021, 2:27pm UTC](https://discourse.openondemand.org/t/haproxy-with-dex-issue/1844/3 "2021-12-16T14:27:42Z")

</div>

Hi Wouter

I had a look into that as well and it seems the issuer in `dex/config.yaml` has the correct value pointing to the proxy:

> issuer: [https://ondemand.example.org:5554](https://ondemand.example.org:5554)

Further down there’s also the following which I don’t know if it’s correct:

```auto
 web:
   http: 0.0.0.0:5556
   https: 0.0.0.0:5554
   tlsCert: "/etc/ood/dex/ondemand000-example-org-chain.pem"
   tlsKey: "/etc/ood/dex/ondemand000.key"
 telemetry:
   http: 0.0.0.0:5558
 staticClients:
 - id: ondemand000.example.org
   redirectURIs:
   - https://ondemand000.example.org/oidc
   name: OnDemand

```

Thanks,  
Chris

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [December 16, 2021, 3:02pm UTC](https://discourse.openondemand.org/t/haproxy-with-dex-issue/1844/4 "2021-12-16T15:02:15Z")

</div>

> [@hadjigc](#):
>
> [https://o](https://o)  
> [ndemand.example.org:5554/.well-known/openid-configuration](http://ndemand.example.org:5554/.well-known/openid-configuration) (Failed connect to \<ondemand000\_ip\>:5554; Connection refused)

You’re getting connection refused. Can you access this URL through a web browser? Seems like you need to open that port 5554 on your proxy.

---

<div class="post-metadata">

**Author:** ![hadjigc](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/hadjigc/32/936_2.png) [@hadjigc](https://discourse.openondemand.org/u/hadjigc)\
**Post date:** [December 22, 2021, 5:43pm UTC](https://discourse.openondemand.org/t/haproxy-with-dex-issue/1844/5 "2021-12-22T17:43:05Z")

</div>

Hi Jeff,

Thanks for the hint, I wasn’t able to access the page although the port was open in the firewall. I’ve had to switch to a test proxy server for now but managed to solve it so here’s what I did in case it helps anyone.  
I got the openid-configuration page in the browser by adjusting haproxy.cfg but it was still giving a curl error in the httpd log when accessing the proxy base url due to the self-signed cert.  
Once the certificate was fixed the following error came up again:

haproxy.example.org\_error\_ssl.log:

```auto
[Wed Dec 22 12:37:06.104516 2021] [auth_openidc:error] [pid 14632] [client <haproxy-ip:33596] oidc_authenticate_user: the URL hostname (ondemand000.example.org) of the configured OIDCRedirectURI does not match the URL hostname of the URL being accessed (haproxy.example.org): the "state" and "session" cookies will not be shared between the two!

```

To fix it I had to change `/opt/rh/httpd24/root/etc/httpd/conf.d/ood-portal.conf` and adjust the `OIDCRedirectURI` to:

```auto
  OIDCRedirectURI https://haproxy-test.example.org/oidc

```

That brings up a page with the error `Bad request Unregistered redirect_uri ("https://haproxy-test.example.org/oidc").`  
The `RedirectURIs` options had to be adjusted as well in `/etc/ood/dex/config.yaml`:

```auto
  redirectURIs:
  - https://haproxy-test.example.org/oidc

```

Login page comes up and the only issue remaining was logout which needed the following change in `/opt/rh/httpd24/root/etc/httpd/conf.d/ood-portal.conf`:

```auto
  Redirect "/logout" "/oidc?logout=https%3A%2F%2Fhaproxy-test.example.org"

```

Were these changes meant to be handled automatically with the `logout_redirect` variable in `ood_portal.yml`? I still need to switch back to the production haproxy but 🤞 no issues come up.

Also here’s the haproxy frontend/backend config for reference:

```auto
frontend main
    bind *:80
    bind *:5554 crt /etc/pki/tls/certs/haproxy-test.pem ssl
    bind *:443 crt /etc/pki/tls/certs/haproxy-test.pem ssl
    default_backend app
    mode http
    stats refresh 10s
    stats show-node
    stats auth <admin_user>:<admin_pass>
    stats uri /haproxy?stats

backend app
    balance roundrobin
    mode http
    timeout tunnel 7200s
    option forwardfor
    http-request redirect scheme https unless { ssl_fc }
    server ondemand <ondemand_ip> ssl check port 443 verify none

```

Regards,  
Chris

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [June 20, 2022, 5:43pm UTC](https://discourse.openondemand.org/t/haproxy-with-dex-issue/1844/6 "2022-06-20T17:43:16Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.