Artifactory Browsing With Nginx & HTTP SSO Too Slow

Question

I have setup a reverse proxy between Nginx and Artifactory, following instructions from here : https://www.jfrog.com/confluence/display/RTF/nginx

I've also enabled HTTP SSO in Artifactory so that a user authenticated by Artifactory is able to log in to Artifactory automatically. Instructions followed from here : https://www.jfrog.com/confluence/display/RTF/Single+Sign-on

Everything is working except that Artifactory is really slow. When I go to the website (eg. artifactory.myorg.com/webapp/#/home,) a progress wheel comes up and it keeps rolling and on every page.

If I turn off Nginx and access Artifactory using its embedded Tomcat engine then everything works fine.

Is there anything I can do to fix this ?

Update The browsing is fine as soon as I turn off the following setting:

proxy_set_header REMOTE_USER $remote_user;

I am guessing that Artifactory is currently processing this user setting for every request and maybe I need to do something at Tomcat side or to Artifactory settings to resolve that.

Here's how my nginx/artifactory config looks (They were generated by Reverse Proxy setup page in Artifactory 4.4):

ssl_certificate      /etc/ssl/certs/dummy.crt;
ssl_certificate_key  /etc/ssl/keys/dummy.key;
ssl_session_cache shared:SSL:1m;
ssl_prefer_server_ciphers   on;

server {
    listen 443 ssl;



server_name dummy.net;
if ($http_x_forwarded_proto = '') {
    set $http_x_forwarded_proto  $scheme;
}
## Application specific logs
access_log /var/log/nginx/dummy-access.log;
error_log /var/log/nginx/dummy-error.log;

rewrite ^/$ /artifactory/webapp/ redirect;
rewrite ^/artifactory$ /artifactory/webapp/ redirect;

location /artifactory/ {

auth_pam              "Secure Zone";
auth_pam_service_name "sevice";

proxy_read_timeout  900;
proxy_pass_header   Server;
proxy_cookie_path ~*^/.* /;
proxy_pass         http://127.0.0.1:8081/artifactory/;

proxy_set_header DUMMY_USER $remote_user;
proxy_set_header   X-Artifactory-Override-Base-Url $http_x_forwarded_proto://$host:$server_port/artifactory;
proxy_set_header    X-Forwarded-Port  $server_port;
proxy_set_header    X-Forwarded-Proto $http_x_forwarded_proto;
proxy_set_header    Host              $http_host;
proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
}

}

Answer 1

Yes. Using Nginx as a reverse proxy should not add noticeable overhead, and could speed up the experience if you use it to serve the static assets.

Your testing so far as implicated Nginx, so posting your related Nginx configuration would be helpful.

But I'll go out a limb and make a guess without seeing it. You are likely using proxy_pass in Nginx to send requests on to Artifactory. If Artifactory is on the same host as Nginx, the proxy_pass address should be a port on 127.0.0.1. If you are instead including a domain name there, then your traffic might doing some like being routed from Nginx back to a load balancer, through CloudFlare, or some other inefficient route.

Answer 2

After trying to reproduce your scenario a few times would recommend to try one more thing to isolate the problem. Try to set a fix username in the REMOTE_USER value, instead of a variable.

proxy_set_header REMOTE_USER username;

BTW, from the snippet it appears the header name is DUMMY_USER and in the example you specified REMOTE_USER. Make sure you the header name is the same as configured in Artifactory under the Admin > Security | HTTP-SSO .

If this issue still reproduces, please contact support@jfrog.com.