Blackboard ssl-offload using x-forwarded-proto unsuccessful

Question

We are trying to off-load SSL processing to our LTM for Blackboard Learn 9.1.201404.160205 and with the use of the header “X-Forwarded-Proto: https.”  To paraphrase, Blackboard documentation states that when the header “X-Forwarded-Proto: https” is provided with an unencrypted session to Blackboard, Blackboard knows the SSL processing has been offloaded upstream and the session between Blackboard and the LTM continues unencrypted.&nbsp;
Below is a crude attempt at representing the desired flow:
USER -&gt; F5 (dst Port 80)&nbsp;
User &lt;- F5 redirect client to use https (dst Port 443) &nbsp;
USER -&gt; F5 https (dst port 443) &nbsp;
F5 -&gt; (has header X-Forwarded-Proto: https inserted) -&gt; Appserver (dst port 8081 http)&nbsp;
F5 &lt;- Appserver (src port 8081 http)&nbsp;
USER &lt;- F5 (src port 443 https)&nbsp;
What we are experiencing is clients providing the X-Forwarded-Proto: https header connecting to the Blackboard application servers using http are being redirected to the https site of the server by the application server.  &nbsp;
With the VIP configured to connect to the pool using http and inserted header X-Forwarded-Proto: https, the application server redirects the client to https.  The LTM passes this redirect to the user, user connects to https VIP, the VIP inserts X-Forwarded-Proto: https header and connects to application server http, the application server sends a redirect back to client/user,…. until user’s browser presents too many redirects message.&nbsp;
F5 support provided an iRule to log header information sent to the application server.  Below is the log viewed from the LTM CLI, “X-Forwarded-Proto: https” is being provided.&nbsp;
Apr  1 15:35:00 slot1/ocs-vip02 info tmm7[10918]: Rule /Common/Header_logger : Accept-Language: en-US,en;q=0.8&nbsp;
Apr  1 15:35:00 slot1/ocs-vip02 info tmm7[10918]: Rule /Common/Header_logger : X-Forwarded-For: aa.bb.cc.dd&nbsp;
Apr  1 15:35:00 slot1/ocs-vip02 info tmm7[10918]: Rule /Common/Header_logger : X-Forwarded-Proto: https&nbsp;
Apr  1 15:35:00 slot1/ocs-vip02 info tmm7[10918]: Rule /Common/Header_logger : 
Apr  1 15:35:04 slot1/ocs-vip02 info tmm[10910]: Rule /Common/Header_logger : Accept-Language: en-US,en;q=0.8&nbsp;
Apr  1 15:35:04 slot1/ocs-vip02 info tmm[10910]: Rule /Common/Header_logger : X-Forwarded-For: aa.bb.cc.dd&nbsp;
Apr  1 15:35:04 slot1/ocs-vip02 info tmm[10910]: Rule /Common/Header_logger : X-Forwarded-Proto: https&nbsp;
Apr  1 15:35:04 slot1/ocs-vip02 info tmm[10910]: Rule /Common/Header_logger : =============================================&nbsp;
Apr  1 15:41:05 slot1/ocs-vip02 info tmm7[10918]: Rule /Common/Header_logger : Accept-Encoding: gzip, deflate, sdch&nbsp;
Apr  1 15:41:05 slot1/ocs-vip02 info tmm7[10918]: Rule /Common/Header_logger : Accept-Language: en-US,en;q=0.8&nbsp;
Apr  1 15:41:05 slot1/ocs-vip02 info tmm7[10918]: Rule /Common/Header_logger : X-Forwarded-For: aa.bb.cc.dd&nbsp;
Apr  1 15:41:05 slot1/ocs-vip02 info tmm7[10918]: Rule /Common/Header_logger : X-Forwarded-Proto: https&nbsp;
Apr  1 15:41:05 slot1/ocs-vip02 info tmm7[10918]: Rule /Common/Header_logger : =============================================&nbsp;
Output from using cURL from the LTM CLI to connect to the Blackboard application server.  The output shows the “X-Forwarded-Proto: https” header is being provided, the Blackboard application server is replying with redirect.&nbsp;
[] config  curl  -v -H "X-Forwarded-Proto:https" -H "X-Forwarded-For: aa.bb.cc.dd"
* About to connect() to ww.xx.yy.zz port 8081 (0)
*   Trying ww.xx.yy.zz... connected
* Connected to ww.xx.yy.zz (ww.xx.yy.zz) port 8081 (0)&nbsp;

GET /webapps/portal/healthCheck HTTP/1.1
User-Agent: curl/7.19.7 (i686-redhat-linux-gnu) libcurl/7.19.7 OpenSSL/0.9.8y zlib/1.2.3 libidn/0.6.5
Host: ww.xx.yy.zz:8081
Accept: /
X-Forwarded-Proto:https
X-Forwarded-For: aa.bb.cc.dd&nbsp;
&lt; HTTP/1.1 301 Moved Permanently
&lt; Server: Apache-Coyote/1.1
&lt; Location: https://ww.xx.yy.zz/webapps/portal/healthCheck
&lt; Content-Length: 0
&lt; Date: Wed, 01 Apr 2015 21:13:07 GMT
&lt; Connection: close
&lt;
* Closing connection 0
[] config &nbsp;

Output from using cURL from a windows PC to connect to the Blackboard application server.  The output shows the “X-Forwarded-Proto: https” header is being provided, the Blackboard application server is replying with redirect.
C:\curl_741_0_ssh2_ssl&gt;curl  --http1.1 -v -S - -k -H "X-Forwarded-Proto:https" -H "X-Forwarded-For: aa.bb.cc.dd"
*   Trying ww.xx.yy.zz...
* Connected to ww.xx.yy.zz (ww.xx.yy.zz) port 8081 (0)&nbsp;

GET /webapps/portal/healthCheck HTTP/1.1
User-Agent: curl/7.41.0
Host: ww.xx.yy.zz:8081
Accept: /
X-Forwarded-Proto:https
X-Forwarded-For: aa.bb.cc.dd&nbsp;
&lt; HTTP/1.1 301 Moved Permanently
&lt; Server: Apache-Coyote/1.1
&lt; Location: https://ww.xx.yy.zz/webapps/portal/healthCheck
&lt; Content-Length: 0
&lt; Date: Thu, 02 Apr 2015 15:21:32 GMT
&lt; Connection: close
&lt;
* Closing connection 0&nbsp;

Are there any known successfully Blackboard/F5 configurations that take advantage of the F5 SSL offload with the use of the X-Forwarded-Proto header?&nbsp;
What could be causing the application server to not accept the F5 VIP, F5 cURL (or windows desktop cURL) provided X-Forwarded-Proto header?&nbsp;
Are there any other users experiencing this issue?  If so, how is it being addressed?
One work around is to encrypt the traffic user to VIP and VIP to application server, no ssl offload.&nbsp;
Are there any possible solutions?  Successfully configurations for both the LTM and windows/blackboard server are greatly appreciated.&nbsp;

amolari · Answer

It seems to me that the backend server is doing what you're asking for: it writes its URLs (here 301 status) with https scheme. Do the clients get the https://<> redirection ? Your VS is listening on 443 and has a client ssl profile. Does it loop on all URIs (wouldn't be a bad idea to log the request HOST+URI in your iRule for troubleshooting)?

steven_89435 · Answer

The application server is unwantingly redirecting http to https.  The application server is to accept http traffic when the Proto header is present.&nbsp;
The clients get the redirect from the application server resulting in the loop.&nbsp;
The VS/VIP is listening on both 80 and 443.  Incoming connections to http:80 on the VIP are redirected by the VIP to https:443 VIP, this is the only redirect that is desired.&nbsp;
Regardlesss of the client (F5 vip, f5 cURL, or windows desktop cURL) the application servers redirect to https.  We see the requests and responses in the cURL output.&nbsp;

amolari · Answer

the app server performs the redirect to https because you're asking him to, with the x-forwarded-proto: https
RFC 7239 :
5.4. Forwarded Proto
   The "proto" parameter has the value of the used protocol type.  The
   syntax of a "proto" value, after potential quoted-string unescaping,
   MUST conform to the URI scheme name as defined in Section 3.1 in
   [RFC3986] and registered with IANA according to [RFC4395].  Typical
   values are "http" or "https".

For example, in an environment where a reverse proxy is also used as
   a crypto offloader, this allows the origin server to rewrite URLs in
   a document to match the type of connection as the user agent
   requested, even though all connections to the origin server are
   unencrypted HTTP.

steven_89435 · Answer

Is there a more layman’s version of this?  It seems that the purpose of the proto is for the server to edit URLs contained within a served document to the URI format the end client believes it is communicating with.  Am I understanding this correctly?&nbsp;
I’m not sure if Blackboard’s use of this header is the same as its intended purpose.&nbsp;
In our case the Blackboard servers are listening http:8081.  Connections to http:8081 are redirected before any content is provided.  Clients are redirected whether the proto is https or http.&nbsp;
C:\curl_741_0_ssh2_ssl&gt;curl  --http1.1 -v -S - -k -H "X-F
orwarded-Proto: https" -H "X-Forwarded-For: aa.bb.cc.dd"
*   Trying ww.xx.yy.zz...
* Connected to ww.xx.yy.zz (ww.xx.yy.zz) port 8081 (0)&nbsp;

GET /webapps/portal/healthCheck HTTP/1.1
User-Agent: curl/7.41.0
Host: ww.xx.yy.zz:8081
Accept: /
X-Forwarded-Proto: https
X-Forwarded-For: aa.bb.cc.dd&nbsp;
&lt; HTTP/1.1 301 Moved Permanently
&lt; Server: Apache-Coyote/1.1
&lt; Location: 
&lt; Content-Length: 0
&lt; Date: Thu, 09 Apr 2015 05:22:41 GMT
&lt; Connection: close
&lt;
* Closing connection 0&nbsp;

C:\curl_741_0_ssh2_ssl&gt;curl  --http1.1 -v -S - -k -H "X-F
orwarded-Proto: http" -H "X-Forwarded-For: aa.bb.cc.dd"
*   Trying ww.xx.yy.zz...
* Connected to ww.xx.yy.zz (ww.xx.yy.zz) port 8081 (0)&nbsp;

GET /webapps/portal/healthCheck HTTP/1.1
User-Agent: curl/7.41.0
Host: ww.xx.yy.zz:8081
Accept: /
X-Forwarded-Proto: http
X-Forwarded-For: aa.bb.cc.dd&nbsp;
&lt; HTTP/1.1 301 Moved Permanently
&lt; Server: Apache-Coyote/1.1
&lt; Location: 
&lt; Content-Length: 0
&lt; Date: Thu, 09 Apr 2015 05:22:51 GMT
&lt; Connection: close
&lt;
* Closing connection 0&nbsp;

arald_den_brabe · Answer

Are you sure you have confgured Bb to accept the inserted headers from the F5? in the bb-config.properties file there is a line where you have to specify an regex with the pattern of the IP adresses used by your F5 so Blackboard knows that haeder insertions from these IP's are valid.

Forum Discussion

Blackboard ssl-offload using x-forwarded-proto unsuccessful

Recent Discussions

ports are showing open on online scanning tool

self-directed requests fail because of no certificate

Decode ObjectSID from Base64-encode string

iRule - Url rewrite and header replace and pool selection not working

ip x-forwarding

Related Content

X-Forwarded-Proto on policy

SSL Offload with HTTP/2.0

HTTP Header Rewrite - X-Forwarded-Proto

SSL Offloading for specific IPs or range of IPs

F5 SSL Offload behind Nginx Reverse Proxy

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS