Problem if behind SSL proxy.

[ThorstenEngel]

This tool saved my life! We have Jira in a version which does not support OAuth2, and Office 365. I fired up a tiny EC2 on AWS. I needed to make a small ugly change to let it work, but you probably have a better solution ;-).

The problem is, that my server listens on http (port 80) and is behind a cloudfront distribution (which of course does SSL-Termination). So in line 628 my response_url begins with http://xxxxx (what is wrong). The redirect_uri begins with https://xxxx (which of course is correct). The match fails because of the wrong scheme.

My assumption is that the wsgi environment does not know about the situation that it is "behind an SSL proxy" and is assuming "http" as scheme.

Do you have a good fix / idea for this?

Warm regards!

[simonrob]

Thanks for the kind words – I'm glad this project is useful.

The redirect_listen_address parameter is attended for this type of scenario, though admittedly not the http/https mismatch in particular. Would it work if you set redirect_listen_address = http://localhost and redirect_uri = https://localhost?

[ThorstenEngel]

Unfortunately now. I tried it a minute ago. This is the (shortened) result in the data dict in line 628:

{'permission_url': 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=cxxxxx&redirect_uri=https%3A%2F%2Fsupport.xxxx.de%2Fprox', 'redirect_uri': 'https://support.xxxx.de/proxy-oauth2', 'redirect_listen_address': 'http://0.0.0.0:80', 'username': 'xxxx', 'expired': False, 'response_url': 'http://support.xxxxx.de/proxy-oauth2?code=0.ATE'}

I can only assume that the problem is created in line 542 by mistakenly assume the http scheme. There must be a trick that I am not aware of for telling the wsgi environ that it is behind a SSL proxy...

[simonrob]

You could work around this by changing this line:

- token_request['response_url'] = wsgiref.util.request_uri(environ)
+ token_request['response_url'] = wsgiref.util.request_uri(environ).replace('http://', 'https://')

But from your first comment I suspect you've already done something similar. A more general solution would probably be to match the parsed host and path but allow a scheme mismatch if enabled via a per-account setting. I'll think about the best way to do this.

[ThorstenEngel]

yes, this pretty much my fix ;-), but I bet, there are better solutions.

[simonrob]

ec95826 allows matching of redirect_uri regardless of scheme, which also helps with another related issue. Let me know how you get on?

[ThorstenEngel]

Dear Simon, yes, this fixes my problem.

Thank you!