Tomcat – Configure Tomcat behind reverseproxy

reverse-proxytomcat

I run a Tomcat 7 server in the local branch of our company. The server was available to public via port 80 and 443. Some days ago the configuration got changed by the HQs admins; Tomcat now needs to be connected by reverse proxy. The HQ admins changed the firewall rules, changed the DNS entry, and configured the reverse proxy. Since they have no experience with tomcat they asked me to change the configuration in order to have Tomcat to listen on 8080 for requests from the reverse proxy.

Tomcat's Connectors are defined as follows:

<Connector port="80" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="443" />
    <Connector
           protocol="HTTP/1.1"
           port="443" maxThreads="400"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="foobar.jks" keystorePass="foo_bar"
           clientAuth="false" sslProtocol="TLS"/>
 <Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000" proxyName="server.company.com" proxyPort="443" />

However, when I call the URI from firefox, I get a "redirect error" stating that there is a redirect that can't be finished.
In Tomcats access log there are entries of the following schema:

<revere proxy internal ip> - - [14/Dec/2015:15:52:31 +0100] "GET / HTTP/1.1" 302 -

If I remove the proxyName and proxyPort connector properties, a redirect to the internal server name of tomcat is sent.

Any help solving this issue is appreciated.

Best Answer

Try adding scheme="https" and secure="true" to the connector with port 8080, assuming the reverse proxy is doing SSL offloading.

Related Solutions

Tomcat – Apache / Tomcat port information

Ok, I'll try answering you.

Consider Apache HTTPD and Apache Tomcat two friends (I'll call them in short HTTPD and Tomcat). Each of them has means of comunicating with other people, let's say by mobile phone and lineland phone or IM.

Tomcat has three phones for recieving calls:

One for recieving international calls in which he speaks the langauage spoken by most people in the (informatic) world, HTTP. This phone has an international agreed subnumber (port) which is 80, but can be any number. It happens that Tomcat being a bit eccentric preferes 8080 by default, so you can speak him HTTP at port 8080 by default.
Another phone for recieving calls from international VIP people, which want to be ultra sure they are speaking with Tomcat and nobody can listen their call, so they speak the previous international language but switching words (encryption, HTTPS). By international agreements this port is 443, but as we said Tomcat is eccentric, he chooses for this port 8443.
The third Tomcat's phone he uses it to recieve calls only from people that speak his own language, AJP (He lives in Java Application Server Country). By International Common Law, it's port 8009.

HTTPD has only two phones for recieving calls

The first two are the same as for Tomcat but HTTPD is not that eccentric prefering to use the normal agreed numbers, 80 for HTTP and 443 for HTTPS.

The story

Now HTTPD has a shop. Sometimes costumers ask for stuff not present in the shop but when he knows Tomcat has it he calls Tomcat and asks him to bring the things.For speaking with Tomcat HTTPD can use international languages, HTTP and HTTPS, but often Tomcat is more happy to speak his own language, AJP. So HTTPD knows that there are two translators that can help him speak AJP with Tomcat, mod_jk (http://tomcat.apache.org/connectors-doc/) and mod_proxy_ajp (https://httpd.apache.org/docs/2.4/mod/mod_proxy_ajp.html).

Now being more serious, by default, HTTPD listens on ports 80 for HTTP and port 443 for HTTPS.

Tomcat listens on port 8080 for HTTP, port 8443 for https and port 8009 for AJP.

You can configure the ports for HTTPS using Listen directives in it's configuration file, httpd.conf or files included from it. So grep for Listen to check them.

You can configure Tomcat for the ports in server.xml. In Tomcat language those are connectors (as opposed to Listen in HTTPD). And as for your configuration, if you setup Tomcat to use HTTPS he will redirect requests in HTTP to the port configured.

Keep in mind, HTTPD keeps care of his ports, Tomcat of his own ports and a port can be in listen only from a single application at a time. So if you have both HTTPD and Tomcat in the same machine, they fit nicely, as the ports used are different by default:

HTTPD: Ports 80 and 443

Tomcat: Ports 8080 8443 and 8009.

Reverse proxy http to tomcat

Instead of plain http proxy, use proxy_ajp. Adapt the example below to match your needs, i.e. it is up to you to proxy everything to the container or only a namespace:

ProxyRequests off
ProxyPassMatch ^/(your_app)(.*) ajp://localhost:8009/$1$2 ttl=120 ping=1

Ensure that server.xml in your tomcat configuration includes an AJP listener. The executor is optional.

<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
          maxThreads="150" minSpareThreads="4"/>

<Connector executor="tomcatThreadPool"
           port="8009" protocol="AJP/1.3"
           connectionTimeout="20000"
           URIEncoding="UTF-8"
           redirectPort="8443" />

Best Answer

Related Solutions

Tomcat – Apache / Tomcat port information

Reverse proxy http to tomcat

Related Topic