Search code examples
spring-securityopenidmod-proxy

Spring Security, OpenID, and mod_proxy

I have an application using spring-security's OpenID implementation. The app server sits behind a proxy. The proxy is apache httpd with mod_proxy. If the proxy connects to the app server via HTTP, the application will tell the OpenID authenticator to redirect back via HTTP rather than HTTPS like I would prefer. It seems to pull the protocol dynamically and only sees HTTP. If I configure the proxy to use HTTPS, I run into this problem. So is there a way to operate spring security behind a proxy which uses HTTP?

Solution

  • A little extra mod_proxy and Glassfish configuration solved this problem for me:

    https://serverfault.com/questions/496888/ssl-issue-with-mod-proxy