authenticate: handlers return a 404 not found if the route contains a port

[haozhou]

1. git checkout v0.0.4
2. make
3. config env and run source ./env
4. run ./bin/pomerium

If I access any URL defined in policy.yml, it redirects me to AUTHENTICATE_SERVICE_URL but then it shows Unknown route HTTP 404.

Here's the console log. I mask secrets and sig.

3:16PM DBG proxy: request duration=0.286107 ip=1xx.xx.xx.xx method=GET pomerium-email= pomerium-user= req_id=d5536f4e-1ad7-92ce-d877-55517010960e size=1935 status=404 url=/sign_in?redirect_uri=https%3A%2F%2Fbugtik.lab.henryzhou.com%3A8443%2F.pomerium%2Fcallback&response_type=code&shared_secret=somesecrets&sig=somesig&ts=1556921814 user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36"

I'm feeling that "sign_in" is not properly handled by the process.

[desimone]

Hi @haozhou ,

Sorry this isn't working as expected.

• Is this for all URLs? Or just bugtik?
• What does your policy file look like?
• What is your env look like?
• Are you running this behind another load balancer?

[haozhou]

1. For all URLs
2. My policy looks like

• from: bugtik.lab.henryzhou.com:8443
  to: http://192.168.2.3
  timeout: 10m
  allowed_users:
  - johnappleseed@gmail.com

3. My env looks like

export ADDRESS=":8443"
export POMERIUM_DEBUG=true
export SERVICE="all"
export AUTHENTICATE_SERVICE_URL=https://authenticate.lab.henryzhou.com:8443
export AUTHORIZE_SERVICE_URL=https://authorize.lab.henryzhou.com:8443
export CERTIFICATE_FILE="./some.pem"
export CERTIFICATE_KEY_FILE="./some.key"
export SHARED_SECRET=xxx
export COOKIE_SECRET=xxx
export IDP_PROVIDER="google"
export IDP_PROVIDER_URL="https://accounts.google.com" # optional for google
export IDP_CLIENT_ID="xxxxx"
export IDP_CLIENT_SECRET="xxxxx"
export POLICY_FILE="./policy.yaml"

No, it's not behind another load balancer. Just a VM behind the router.

[haozhou]

Also the callback URL in google API console has :8443 port specified in the URL

[desimone]

When you start the server, what is the debug message?
For example,

5:13PM DBG add email group=bdd@pomerium.io route=weirdlyssl.corp.beyondperimeter.com

My hunch is that it has to do with you having a port set on your proxied domain. (But we should support that).

[desimone]

Okay. I've been able to reproduce the issue. This isn't' actually related to the proxy service but because the auth service handler isn't stripping the port and thus isn't handling the authenticate service handlers properly.

	if authenticateService != nil {
		topMux.Handle(authHost+"/", authenticateService.Handler())
	}

See:

• net/http: document and test behavior of ServeMux with ports golang/go#23351