![Apache 反向代理不工作并生成 404 错误](https://linux22.com/image/768053/Apache%20%E5%8F%8D%E5%90%91%E4%BB%A3%E7%90%86%E4%B8%8D%E5%B7%A5%E4%BD%9C%E5%B9%B6%E7%94%9F%E6%88%90%20404%20%E9%94%99%E8%AF%AF.png)
我安装了在 Jetty 9 上运行的 Shiboleth。通过 Apache,我有一个到 Jetty 8080 端口的反向代理,该代理为 Shiboleth 实例提供服务。
当我在控制台中 curl http://localhost:8080/idp/shibboleth 时,实例响应正确生成。
但是当我在浏览器上执行同样操作时https://idp.example.com/idp/shibboleth我收到 404 错误。
这是否表明反向代理无法正常工作?
这是我的 Apache 配置
SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache shmcb:/var/run/ocsp(128000)
<VirtualHost *:80>
ServerName "idp.spectrum.com.cy"
Redirect permanent "/" "https://idp.spectrum.com.cy/"
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerName idp.spectrum.com.cy:443
ServerAdmin [email protected]
# Debian
CustomLog /var/log/apache2/idp.spectrum.com.cy.log combined
ErrorLog /var/log/apache2/idp.spectrum.com.cy.org-error.log
# Centos
#CustomLog /var/log/httpd/idp.example.org.log combined
#ErrorLog /var/log/httpd/idp.example.org-error.log
DocumentRoot /var/www/html/idp.spectrum.com.cy
SSLEngine On
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4"
SSLHonorCipherOrder on
# Disallow embedding your IdP's login page within an iframe and
# Enable HTTP Strict Transport Security with a 2 year duration
<IfModule headers_module>
Header set X-Frame-Options DENY
Header set Strict-Transport-Security "max-age=63072000 ; includeSubDomains ; preload"
</IfModule>
# Debian
SSLCertificateFile /etc/ssl/certs/idp.spectrum.com.cy.crt
SSLCertificateKeyFile /etc/ssl/private/idp.spectrum.com.cy.key
# ACME-CA or GEANT_OV_RSA_CA_4 (For users who use GARR TCS/Sectigo RSA Organization Validation Secure Server CA)
#SSLCACertificateFile /etc/ssl/certs/ACME-CA.pem
#SSLCACertificateFile /etc/ssl/certs/GEANT_OV_RSA_CA_4.pem
# Centos
#SSLCertificateFile /etc/pki/tls/certs/idp.example.org.crt
#SSLCertificateKeyFile /etc/pki/tls/private/idp.example.org.key
# ACME-CA or GEANT_OV_RSA_CA_4 (For users who use GARR TCS/Sectigo RSA Organization Validation Secure Server CA)
#SSLCACertificateFile /etc/pki/tls/certs/ACME-CA.pem
#SSLCACertificateFile /etc/pki/tls/certs/GEANT_OV_RSA_CA_4.pem
<IfModule mod_proxy.c>
ProxyPreserveHost On
RequestHeader set X-Forwarded-Proto "https"
ProxyPass /idp http://localhost:8080/idp/ retry=5
ProxyPassReverse /idp http://localhost:8080/idp/ retry=5
<Location /idp>
Require all granted
</Location>
</IfModule>
</VirtualHost>
</IfModule>
<VirtualHost 127.0.0.1:80>
ProxyPass /idp http://localhost:8080/idp/ retry=5
ProxyPassReverse /idp http://localhost:8080/idp/ retry=5
<Location /idp>
Require all granted
</Location>
</VirtualHost>
我简化了我的 conf 文件以删除 https。下面的配置工作正常,但仅适用于 http。我将调查为什么 https 配置会产生 404 错误。
<VirtualHost *:80>
ServerName idp.spectrum.com.cy
<IfModule mod_proxy.c>
ProxyPreserveHost On
ProxyPass /idp/ http://localhost:8080/idp/ retry=5
ProxyPassReverse /idp/ http://localhost:8080/idp/ retry=5
<Location /idp>
Require all granted
</Location>
</IfModule>
# This virtualhost is only here to handle administrative commands
for Shibboleth, executed from localhost
<VirtualHost 127.0.0.1:80>
ProxyPass /idp http://localhost:8080/idp/ retry=5
ProxyPassReverse /idp http://localhost:8080/idp/ retry=5
<Location /idp>
Require all granted
</Location>
</VirtualHost>
答案1
应该是
ProxyPass /idp/ http://localhost:8080/idp/
请注意命令第一个参数中的尾部斜杠ProxyPass
。始终对齐两个参数中的尾部斜杠。
我的VirtualHost
声明非常简单并且只包含工作所需的最低限度的内容:
<VirtualHost *:80>
DocumentRoot /var/www/html
ServerName idp.example.com
ServerAlias idp
ErrorLog logs/error_log
CustomLog logs/access_log
</VirtualHost>
<VirtualHost *:443>
DocumentRoot /var/www/html
SSLEngine on
SSLProxyEngine on
SSLCertificateKeyFile /etc/pki/tls/private/idp.example.com.key
SSLCertificateFile /etc/pki/tls/certs/idp.example.com.crt
SSLCertificateChainFile /etc/pki/tls/certs/chain.crt
ServerName idp.example.com
ServerAlias idp
ErrorLog logs/ssl-error_log
CustomLog logs/ssl-access_log combined
</VirtualHost>
这是我的 IDP /etc/httpd/conf.d/idp.conf
:
ProxyPass /idp/ http://localhost:8080/idp/ retry=5
ProxyPassReverse /idp/ http://localhost:8080/idp/
<Proxy http://localhost:8080>
Require all granted
RequestHeader set X-Forwarded-Proto https
RequestHeader set X-Proxied-Https on
RequestHeader set Proxy-ssl-id %{SSL_SESSION_ID}s
</Proxy>
答案2
尝试从指令中删除端口ServerName
。例如,
ServerName idp.spectrum.com.cy
每https://httpd.apache.org/docs/2.4/mod/core.html#servername该端口是可选的和允许的,但文档中下面提到的听起来像可能是该配置未被拾取的原因VirtualHost
(浏览器不会在Host:
标头中发送端口号)。
如果你正在使用基于名称的虚拟主机,
ServerName
里面<VirtualHost>
部分指定什么主机名必须出现在请求的Host:
标头中才能匹配此虚拟主机。