Undertow redirect port for HTTPS

[froed]

Hi all,

the last days I tried to setup WildFly 8.0.0.Beta1 to work with HTTPS. The only thing not working yet is the redirection of HTTP -> HTTPS.

To my knowledge I have to setup Realm and https listener and add CONFIDENTIAL to web.xml.

<security-realm name="UndertowRealm">

                <server-identities>

                    <ssl>

                        <keystore

                            relative-to="jboss.server.config.dir"

                            path="path-to-keystore"                           

                            keystore-password="the-pwd"/>

                    </ssl>

                </server-identities>

            </security-realm>

<https-listener name="https" socket-binding="https" security-realm="UndertowRealm"/>

and in web.xml

<security-constraint>

  <web-resource-collection>

      <url-pattern>/*</url-pattern>

  </web-resource-collection>

  <user-data-constraint>

      <transport-guarantee>CONFIDENTIAL</transport-guarantee>

  </user-data-constraint>

</security-constraint>

the part in the web.xml seems to be responsible for the redirect HTTP -> HTTPS which returns for http://domain.net -> https://domain.net

I am using the Wildfly in the cloud and the cloud provider allows to define port mapping from public to private ports. In the case of Wildfly I have the following:

Public -> Private

80 -> 8080

443 -> 8443

What happens is that the request http://domain.net is redirected to https://domain.net:8443 instead of https://domain.net

My question is now, how can I configure the Wildfly to redirect to 443 instead of 8443 but still use the binding port 8443 for HTTPS???

[ctomc]

Hey,

the best way to configure it to create jira issue for this.

I have it on my todo list for a while but never managed to get it done.

It should be easy fix in the subsystem with re-introduction of redirect-port attribute on http connector.

--

tomaz

[froed]

OK, thank you for the response.

Done!

see: [WFLY-98] http -> https redirect port not respecting offset - JBoss Issue Tracker

[ctomc]

Fix is done in PR

WFLY-2625 Undertow 'redirect-port' parameter for HTTPS by ctomc · Pull Request #5593 · wildfly/wildfly · GitHub

[froed]

Thank you Tomaz,

your changes were merged already,

WFLY-2625 WFLY-2653 WFLY-2196 WFLY-1070 Undertow subsystem upgrades by ctomc · Pull Request #5593 · wildfly/wildfly · Gi…

but it looks like it was not merged completely.

see my comment in PR

I used the nightly build and it doesn't work with the last build #831:

https://ci.jboss.org/hudson/job/WildFly-latest-master/lastSuccessfulBuild/artifact/build/target/wildfly-8.x.zip

[ctomc]

Hey,

there was extra commit to implement [WFLY-1070] Add a redirect-socket configuration to the web connector config - JBoss Issue Tracker which helps in domain deployments or in scenarios when you want to have many servers running on same machine by just defining port-ofset.

in short, instead of having static port defined in redirect-port you now  have redirect-socket which is reference to port-binding that you can find on bottom of standalone.xml

by default redirect-socket has value of "https" and as such references <socket-binding name="https" port="${jboss.https.port:8443}"/>

so in short if you want to redirect to 443, all you need to do is change socket binding to 443.

--

tomaz

[froed]

got it now :-)

for my scenario using cloud service I defined:

<socket-binding name="https" port="${jboss.https.port:8443}"/>

<socket-binding name="https-ext" port="${jboss.https.port:443}"/>

and the http-listener with:

<http-listener name="default" socket-binding="http" redirect-socket="https-ext" />

assuming the cloud provider configuration above, this will lead to:

redirected to https://domain.net/ instead of https://domain.net:8443/ if the user types http://domain.net in his browser

nice solution, thanks for your effort

[dnovo]

Hi,

How to redirect without changing web.xml? It's possible?

<security-constraint>

  <web-resource-collection>

      <url-pattern>/*</url-pattern>

  </web-resource-collection>

  <user-data-constraint>

      <transport-guarantee>CONFIDENTIAL</transport-guarantee>

  </user-data-constraint>

</security-constraint>