topic SSO doesn't work with reverse proxy in Alfresco Archive

SSO doesn't work with reverse proxy

vgusev2007 — Thu, 17 Jul 2014 06:50:44 GMT

Hi all!I use Alfresco 4.2.2 Enterprice on a Linux platform.I have setup SSO via: http://docs.alfresco.com/4.2/tasks/auth-kerberos-ADconfig.html it works fine. But, I need to setup a reverse proxy (I use nginx). It works too, but SSO.PLEASE read my logs and sheme, I'd like if you help me.So, I have t

Re: SSO doesn't work with reverse proxy

kimberlydeborah — Fri, 19 Sep 2014 06:42:48 GMT

The reverse proxy based approach is quite flexible and supports multiple SSO solutions. This approach is considered the best practice when configuring SSO for CentraSite.

Re: SSO doesn't work with reverse proxy

vgusev2007 — Tue, 07 Oct 2014 06:20:31 GMT

I have setup mod_jk + apache - it works fine for me.

Re: SSO doesn't work with reverse proxy

heiko_robert — Wed, 15 Oct 2014 16:32:47 GMT

we use mod_proxy_ajp + apache and this works fine (Ubuntu 4.2.e/f and Ubuntu 12.04 LTS) but this aproach has other problems since Alfresco Share is so hungry in terms of http threads per share page. It is not easy to scale with several hundred concurrent users if you use apache reverse proxy. You need to tune apache for that.
I've seen a lot of configs which solves this issue much better with nginx but I haven't seen a working nginx config so far which has no problem with WebDAV, SPP, Kerberos.

Are there any nginx experts having experience with Alfresco config working with WebDAV, SPP and Kerberos?

Re: SSO doesn't work with reverse proxy

vgusev2007 — Fri, 17 Oct 2014 05:44:27 GMT

I don't use ajp. I use: jk

It lookss like this one:


<VirtualHost *:80>
        ServerName test.company.ru
        ServerAlias www.test.company.ru
        Redirect / https://test.company.ru/share
</VirtualHost>
<virtualhost *:443>
        ServerName test.company.ru
        ServerAlias www.test.company.ru
        SSLEngine On
        SSLCertificateFile /etc/apache2/cert/test.company.ru.crt
        SSLCertificateKeyFile /etc/apache2/cert/test.company.ru.key
        SSLCACertificateFile /etc/apache2/cert/SSL123_CA_Bundle.pem
        ErrorDocument   503     "/custom_errors/maintenance.html"
        RedirectMatch ^/$ /share/
        jkMount /alfresco ajp13_worker
        jkMount /alfresco/* ajp13_worker
        jkMount /share ajp13_worker
        jkMount /share/* ajp13_worker
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍