I'm currently trying to connect CMIS Explorer (Android app) to Nuxeo DM 5.5. In my current setup, Nuxeo runs behind an SSO solution called LemonLDAP, acting as a reverse proxy. The SSO part works well - through mod_sso. The publicly accessible URL uses HTTPS. There's no service listening on plain HTTP.
In order to CMIS clients to connect, I asked my SSO proxy to do just plain reverse-proxying (no authentication or redirection of any kind) on ^/nuxeo/atom/cmis.*. I also asked Nuxeo to stop using FORM_AUTH or PROXY_AUTH on such URLs, by adding a custom contribution. This part works well : curl -k "https://my.public.host/nuxeo/atom/cmis" answers with a bit of application/atomsvc+xml.
But clients still don't work, and I read what's in the "atomsvc+xml". And there I found numerous URLs starting with http://my.public.host/. There's clearly no way it's going to work without https, but how could I explain Nuxeo not to publish plain HTTP URLs?
