1

We have a Kubernetes cluster where we expose an internal service with Nginx. Note that we are not using an ingress resource, but instead deploy an Nginx controller which is bound to an external IP address. Therefore, the Nginx container listens to ports 8080 and 8443 (binding to 80 and 443 is not possible as that would require root) and requests to port 80 and 443 are forwarded to the container.

The exposed service is running on https://<service-url> and is accessible without a problem.

However, on login to the service using SAML 2.0, the callback is redirected to https://<service-url>:8443 instead of the expected https://<service-url>. The callback url is https://<service-url>/oauth2/saml/callback

Here is our nginx configuration. Does anybody have an idea why this might happen?

server {
    listen 8080;
    return 301 https://$host$request_uri;
}
server {
    server_name service-url;
    listen 8443;
    ssl on;
    ssl_certificate     ...;
    ssl_certificate_key ...;
    ssl_session_timeout  5m;

    location / {
        client_max_body_size 100m;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_pass http://<internal-service>;
    }
}

As you can see, for some reason Nginx thinks that the request needs to be redirected and appends it's own container port. Any ideas on why that might happen and how to fix it?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.