Error when accessing the Wildfly Management Console - Authentication required

Question

I'm receiving the error Authentication required after I login in the Wildfly 13 Management Console.

If I type a user or password wrong, it asks again, but if I type correctly it shows the page with the error message (so I assume the user and password are correct, but something else after that gives the error).

I'm using docker to run a nginx container and a wildfly container.

The nginx listens externally on port 9991 and proxy pass the request to the wildfly container, but it shows the error described before.

It just happens with the Wildfly Console, every other request proxied, even request proxied to a websocket or to Wildfly on port 8080, are done successfully.

The Wildfly container listens externally on port 9990 and I can access the console successfully in this port. If on docker I map the port "9992:9990" I still can access the console successfully through port 9992.

So, it seems that this is not related to docker, but to the Wildfly Console itself. Probably some kind of authentication that is not happening successfully when using a reverse proxy in the middle.

I have a demo docker project on https://github.com/lucasbasquerotto/pod/tree/0.0.6, and you can download the tag 0.0.6 that has everything setup to work with Wildfly 13 and nginx, and to simulate this error.

git clone -b 0.0.6 --single-branch --depth 1 https://github.com/lucasbasquerotto/pod.git
cd pod
docker-compose up -d

Then, if you access the container directly in http://localhost:9990 with user monitor and password Monitor#70365 everything works.

But if you access http://localhost:9991 with the same credentials, through the nginx reverse proxy, you receive the error.

My nginx.conf file:

upstream docker-wildfly {
  server wildfly:9990;
}

location / {
  proxy_pass         http://docker-wildfly;
  proxy_redirect     off;
  proxy_set_header   Host $host;
  proxy_set_header   X-Real-IP $remote_addr;
  proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header   X-Forwarded-Host $server_name;
}

I've also tried with:

proxy_set_header   X-Forwarded-Proto $scheme;

And also with the Authorization header (just the 2nd line and also with both):

proxy_set_header   Authorization $http_authorization;
proxy_pass_header  Authorization;

And also defining the host header with the port (instead of just $host):

proxy_set_header   Host $server_addr:$server_port;

I've tried the above configurations isolated and combined together. All to no avail.

Any sugestions?

Has anyone successfully accessed the Wildfly Console through a reverse proxy?

Update (2018-09-22)

It seems Wildfly uses a digest authentication (instead of basic).

I see the header in the console like the following:

Authorization: Digest username="monitor", realm="ManagementRealm", nonce="AAAAAQAAAStPzpEGR3LxjJcd+HqIX2eJ+W8JuzRHejXPcGH++43AGWSVYTA=", uri="/console/index.html", algorithm=MD5, response="8d5b2b26adce452555d13598e77c0f63", opaque="00000000000000000000000000000000", qop=auth, nc=00000005, cnonce="fe0e31dd57f83948"

I don't see much documentation about using nginx to proxy pass requests with digest headers (but I think it should be transparent).

One question I saw here in SO is https://serverfault.com/questions/750213/http-digest-authentication-on-proxied-server, but there is no answer so far.

I saw that there is the nginx non-official module https://www.nginx.com/resources/wiki/modules/auth_digest/, but in the github repository (https://github.com/atomx/nginx-http-auth-digest) it says:

The ngx_http_auth_digest module supplements Nginx's built-in Basic Authentication module by providing support for RFC 2617 Digest Authentication. The module is currently functional but has only been tested and reviewed by its author. And given that this is security code, one set of eyes is almost certainly insufficient to guarantee that it's 100% correct. Until a few bug reports come in and some of the ‘unknown unknowns’ in the code are flushed out, consider this module an ‘alpha’ and treat it with the appropriate amount of skepticism.

Also it doesn't seem to me allright to hardcode the user and pass in a file to be used by nginx (the authentication should be transparent to the reverse proxy in this case).

In any case, I tried it and it correctly asks me to authenticate, even if the final destination does not have a digest authentication, like when trying to connect to the wildfly site (not console), it asks when trying to connect to nginx (before proxying the request), then it forwards successfully to the destination, except in the case of wildfly console, it keeps asking me to authenticate forever.

So I think this is not the solution. The problem seems to be in what the nginx is passing to the Wildfly Console.

Error when accessing the Wildfly Management Console - Authentication required

Update (2018-09-22)

Answers (1)

Related Questions