SAML_FAKE_HTTPS needs to be configurable without requiring debug mode

Question

SAML_FAKE_HTTPS needs to be configurable without requiring debug mode

pavelnikolov opened this issue 7 years ago · comments

When we run Confidant using Kubernetes we have problems when the SAML_FAKE_HTTPS is set to false. We would like to set it to true without enabling debug mode. Otherwise we get this error:

{
  "errors": [
    "invalid_response"
  ], 
  "message": "SAML request failed", 
  "reason": "The response was received at http://XXXXX/saml/consume instead of https://XXXXX/saml/consume", 
  "request_id": null
}

Ryan Lane · Answer 1 · Tue Mar 28 2017 06:02:01 GMT+0800 (China Standard Time)

We only currently support SAML with https, as it's insecure without. Is this for testing purposes?

Pavel Nikolov · Answer 2 · Tue Mar 28 2017 07:42:51 GMT+0800 (China Standard Time)

It's for production application deployed in Kubernetes. But I believe that any app with a reverse proxy in front of it would have the same problem..

Ryan Lane · Answer 3 · Tue Mar 28 2017 07:52:40 GMT+0800 (China Standard Time)

If you have a reverse proxy in front then X-Forwarded-Proto should solve your problem here. You need to set --forwarded-allow-ips=* for your gunicorn config for this, though; see #50

Ryan Lane · Answer 4 · Wed Mar 29 2017 05:49:50 GMT+0800 (China Standard Time)

Did this solve your issue? I really need to close out #50. Pretty frequent issue folks run into.

Frode Egeland · Answer 5 · Wed Apr 19 2017 13:17:50 GMT+0800 (China Standard Time)

Yes, that fixes it - please make this the default in your docker image.

Ryan Lane · Answer 6 · Thu Apr 20 2017 02:30:18 GMT+0800 (China Standard Time)

In #50 I mentioned that we're recommending setting the FORWARDED_ALLOW_IPS environment var when running the docker image, because it's difficult to modify the setting if we set it by default in the image. We may followup later and have the docker image run a script as a command where we have a bit more flexibility in how we start the process in docker.