Trying to configure a reverse proxy to allow external access to an outlook web access server. I am able to route traffic to the OWA site, present the login form, however OWA rejects the login with a successful username/password with a: "Your session has timed out...." error.
Looking through my custom log files, somehow the session ID and/or expired args get lost through the GET & POST process on the proxy:
10.8.10.4 - - - [30/Jul/2013:10:19:30 -0700] - "GET / HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:30 -0700] - "-" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET / HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "-" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET / HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET /owa HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET /owa/ HTTP/1.1" ||| "SentCookie"= sessionid=; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET /owa/auth/logon.aspx?url=https://email/owa/&reason=0 HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET /owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2femail%2fowa%2f HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:37 -0700] - "POST /owa/auth.owa HTTP/1.1" ||| "SentCookie"= sessionid=d0c8c16a-46ef-4230-ba23-cb6403b930dd; path=/
10.8.10.4 - - - [30/Jul/2013:10:19:37 -0700] - "GET /owa/ HTTP/1.1" ||| "SentCookie"= sessionid=; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT
10.8.10.4 - - - [30/Jul/2013:10:19:37 -0700] - "GET /owa/auth/logon.aspx?url=https://email/owa/&reason=3 HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:38 -0700] - "GET /owa/auth/logon.aspx?replaceCurrent=1&reason=3&url=https%3a%2f%2femail%2fowa%2f HTTP/1.1" ||| "SentCookie"= -
Here's my nginx.conf:
#//start//
user www-data;
worker_processes 4;
pid /var/run/nginx.pid;
events {
worker_connections 768;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
##
# Gzip Settings
##
gzip on;
gzip_disable "msie6";
log_format main1 '$remote_addr - $remote_user - [$time_local] - "$request" '
' ||| "SentCookie"= $sent_http_set_cookie ';
access_log /var/log/nginx/owa_combined_ssl.log main1;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
#//end
And OWA site config:
#//start//
server {
listen 80;
server_name email;
rewrite ^(,*) https://email$1 permanent;
}
server {
listen 443;
server_name email;
rewrite ^/$ https://email/owa permanent;
ssl on;
ssl_certificate /etc/ssl/certs/myssl.crt;
ssl_certificate_key /etc/ssl/private/myssl.key;
ssl_session_timeout 5m;
ssl_session_cache off;
proxy_read_timeout 360;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass_header Set-Cookie;
proxy_pass_header P3P;
location /owa { proxy_pass https://internal-email-server/owa; }
}
#//end
Is there any way to configure the cookie/session ID to be dictated by the upstream OWA server?
Looking through my custom log files, somehow the session ID and/or expired args get lost through the GET & POST process on the proxy:
10.8.10.4 - - - [30/Jul/2013:10:19:30 -0700] - "GET / HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:30 -0700] - "-" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET / HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "-" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET / HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET /owa HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET /owa/ HTTP/1.1" ||| "SentCookie"= sessionid=; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET /owa/auth/logon.aspx?url=https://email/owa/&reason=0 HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:32 -0700] - "GET /owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2femail%2fowa%2f HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:37 -0700] - "POST /owa/auth.owa HTTP/1.1" ||| "SentCookie"= sessionid=d0c8c16a-46ef-4230-ba23-cb6403b930dd; path=/
10.8.10.4 - - - [30/Jul/2013:10:19:37 -0700] - "GET /owa/ HTTP/1.1" ||| "SentCookie"= sessionid=; path=/; expires=Thu, 01-Jan-1970 00:00:00 GMT
10.8.10.4 - - - [30/Jul/2013:10:19:37 -0700] - "GET /owa/auth/logon.aspx?url=https://email/owa/&reason=3 HTTP/1.1" ||| "SentCookie"= -
10.8.10.4 - - - [30/Jul/2013:10:19:38 -0700] - "GET /owa/auth/logon.aspx?replaceCurrent=1&reason=3&url=https%3a%2f%2femail%2fowa%2f HTTP/1.1" ||| "SentCookie"= -
Here's my nginx.conf:
#//start//
user www-data;
worker_processes 4;
pid /var/run/nginx.pid;
events {
worker_connections 768;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# Logging Settings
##
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
##
# Gzip Settings
##
gzip on;
gzip_disable "msie6";
log_format main1 '$remote_addr - $remote_user - [$time_local] - "$request" '
' ||| "SentCookie"= $sent_http_set_cookie ';
access_log /var/log/nginx/owa_combined_ssl.log main1;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
#//end
And OWA site config:
#//start//
server {
listen 80;
server_name email;
rewrite ^(,*) https://email$1 permanent;
}
server {
listen 443;
server_name email;
rewrite ^/$ https://email/owa permanent;
ssl on;
ssl_certificate /etc/ssl/certs/myssl.crt;
ssl_certificate_key /etc/ssl/private/myssl.key;
ssl_session_timeout 5m;
ssl_session_cache off;
proxy_read_timeout 360;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass_header Set-Cookie;
proxy_pass_header P3P;
location /owa { proxy_pass https://internal-email-server/owa; }
}
#//end
Is there any way to configure the cookie/session ID to be dictated by the upstream OWA server?