0

I need help to solve my issue.

What I want to achieve is

http://abc.contoso.com -> https://abc.contoso.com (Force redirection HTTP to HTTPS)

My problem is that the URI needed for Azure OAuth 2.0 authorization endpoint doesn’t match.

The accepted URI as destination when returning authentication responses (tokens) after successfully authenticating users must be: https://abc.contoso.com/signin-oidc

But HAProxy sends the HTTP form as below:

https://login.microsoftonline.com/bdeebc-dd/oauth2/authorize?client_id=fd&redirect_uri=http%3A%2F%2Fabc.contoso.com%2Fsignin-oidc&response_type=id_token&scope=openid profile&response_mode=form_post

What should I do to have the HTTPS form (redirect_uri=https%3A%2F%2Fabc.contoso.com%2Fsignin-oidc) instead of HTTP for OAuth ?

My config is

Front-end

frontend public_front_end
bind *:80
mode http
option forwardfor
redirect scheme https code 301 if !{ ssl_fc }

frontend public_secured_front_end
bind *:443 ssl crt /etc/haproxy/certs

Back-end

use_backend abc-api if { hdr(host) -i abc.contoso.com }

backend abc-api

mode http

http-request add-header X-Forwarded-Proto https

server webserver01 192.168.0.1:4569 check

option forwardfor

Thanks

Emma
  • 1
  • 2
  • Wouldn't it be the backend that's sending "https://login.microsoftonline.com/bdeebc-dd/oauth2/authorize?client_id=fd&redirect_uri=http%3A%2F%2Fabc.contoso.com%2Fsignin-oidc&response_type=id_token&scope=openid profile&response_mode=form_post" ? I don't see HaProxy doing that. – Gerard H. Pille Apr 24 '20 at 15:17
  • Yes, the backend is using the OAuth endpoint and I just need HAProxy to redirect the HTTPS URL to the backend instead of the HTTP one (I think?) so the endpoint can use the right authorized URI. – Emma Apr 24 '20 at 16:16
  • Why don't you make the backend use "redirect=h t t p s ://abc.contoso.com/signin-oidc" – Gerard H. Pille Apr 24 '20 at 16:28
  • How can I put in in HAProxy language? – Emma Apr 24 '20 at 16:35
  • You need to change the backend configuration, not the haproxy. – Gerard H. Pille Apr 24 '20 at 16:37

1 Answers1

0

You need to update the Azure AD application you have setup to do this authentication to add a reply URL for the https endpoint.

Sam Cogan
  • 38,736
  • 6
  • 78
  • 114