SQ redirects to http instead of https after login with SAML/ADFS behind NGINX reverse proxy

[saas2813 (Samuel Åslund)]

Running SonarQube v.8.9.1 LTS
RHEL 8.5.
nginx v.1.14.1

We are trying to configure SSO with ADFS/SAML.
SonarQube is currently running with local Auth after configuring the proxy-settings for NGINX as described here:

• Install the Server | SonarQube Docs
• Operating the Server | SonarQube Docs

We have got the Auth working with our ADFS but the redirect returned points to HTTP instead of HTTPS.
After login we get a timeout since the http-request is blocked by a firewall, but manually opening a https url to sonarqube shows that the login succeded.
(I had the same problem with the internal auth before setting the proxy-headers.)
All topics I have found here ends up at either changing somthing in AWS or setting a 302 redirect from http to https in the proxy. Neither works for me.
The last post in this thread refers to some configuration in the bundled Catalina/Tomcat server:

Redirect to sonarqube on http after Gitlab Authentication

I think we were seeing the same issue and have been able to solve it, or at least work around it. TL;DR: Use this in your nginx config: proxy_redirect http://$host https://$host; We are using SAML for authentication with our SQ 8.8 instance. The issue we saw was that the POST request to the callback url (https://<sonar-url>/oauth2/callback/saml) was answered with a 302 redirect to http://<sonar-url>/<the-rest>. So we went digging. The issue, I think, is that the construction of the redirect …

This SO question seems to indicate that I need to tell Catalina that my Proxy actually is a trusted proxy:

Handling X-FORWARDED-PROTO header in Java web application

Could anyone help me find how to make SAML Auth redirect to return https?
Or possibly give me pointers on how to reconfigure catalina ?
(I can not find any server.xml in the sonar-application-xxx.jar )

[ganncamp (G Ann Campbell)]

Hi,

Is IIS in the mix? If so, this guide may be helpful:

SonarQube Users: Let's talk about IIS and SAML Authentication!

Hey SonarQube Users! When operating a SonarQube instance, the supported way to serve SonarQube over HTTPS is to secure the server behind a proxy. For those who host their SonarQube server on Windows, the reverse proxy of choice is often IIS. The intent of this guide is not to elaborate on how to set up a reverse proxy with IIS. There are more than enough IIS gurus out there and tutorials in existence to get you started. The goal is to focus on two tricky, and relatively new requirements to ha…

 
Ann

[saas2813 (Samuel Åslund)]

Hi,

No we are not using IIS we use NGINX on Linux.
We are running SonarQube locally on a manually administrated RedHat server.
The part of Authentication mentioned in the IIS link bove seems to be about connecting SonarQube to the SAML-auth this actually works for us. It is the final redirect telling the client that Auth is done and to open the SonarQube page that points wrongw. Internal authentication responds with a correct redirect so the Proxy config should be working.

The actuall response header when completing the login with SAML ADFS says:
location: http://sonarqube…
While the same response for internal auth says
location: https://sonarqube…

[ganncamp (G Ann Campbell)]

Hi,

That guide I linked to does cover that point and might be useful even if you’re not using IIS. Can you double-check the headers it mentions?

 
Ann

[saas2813 (Samuel Åslund)]

Hi, We have added the headers sugested in the article above.
It did not help.

[CalebC (Caleb Ciampaglia)]

We are facing the same issue (redirection to non-secure URL after SSO login using Github to authenticate). We have verified that the settings of the sonar base URL and callback URLs in the Github app refer to the secure URL.

Has there been any progress on this issue (either through investigation or fix)?

[Necip]

Hi,
Sonar documantation (Operating the Server | SonarQube Docs) for nginx is made me crazy for troubleshooting SAML for Google Workspace takes my 1-1.5 days, than the tric is

proxy_set_header X-Forwarded-Proto $scheme;

Not https nor http etc.

[saas2813 (Samuel Åslund)]

It turned out that we needed to add a line

proxy_redirect https://sonarqube-url http://sonarqube-url ;

In our NGINX reverse proxy definition.