Confused about redirect with proxy

[krisl]

I have a requirement to first "redirect" my login http page to an https page and then serve this https (jsp) page through a backend tomcat server through the proxy rewrite. There are multiple tomcat servers and i look these up through a map.

My main issue is that the rewrite engine seems to redirect to https and then the following rewrite proxy rule causes the

RewriteMap sdmap txt:conf/sub-domain-map.txt
RewriteCond %{HTTPS}!=on
RewriteRule ^/(.*)$ [%{SERVER_NAME}:8444...] [R]
>>> this causes the redirect to https correctly

RewriteCond %{HTTP_HOST} (.*)\.example\.com
RewriteRule ^.*:8444/$ ${sdmap:%1}/subDomainLogin.do?subdomain=%1 [P,L]
>>> this rewrites "/" to the right proxy server

So if I go to http://subdomain.example.com,
it first gets rewritten to [subdomain.example.com:8444...]
which then gets proxied to
http://<internal_ip_address>:<port>/subDomainLogin.do?subdomain=subdomain
which serves up the right page content.

However, end result is that the browser is still showing the original http URL (http://subdomain.example.com) instead of the redirected https url (https://subdomain.example.com:8444).

Can anyone please point me in the right direction?

[edited by: jdMorgan at 12:18 pm (utc) on Oct. 16, 2007]
[edit reason] de-linked [/edit]

[jdMorgan]

The simple answer may be that in order to invoke the redirect, you need to use an [L] flag on the first rule rule.

Some other points:

%{HTTPS} is not an Apache-native variable; It gets defined by some other program or module, and I've seen cases where it is undefined, or perhaps defined by a module that runs after mod_rewrite (making it undefined when mod_rewrite is invoked). An explicit test for %{SERVER_PORT} ^443$ or in your case, %{SERVER_PORT} ^8444$ would be 'safer'.

Once you've added an [L] flag to the first rule, the test for the port number in the URL-path in the second rule will no longer work. This is because the port number is not part of the client-requested URL-path as 'seen' by RewriteRule. Instead, use %{HTTP_HOST} to get the requested port number. HTTP_HOST will look like this:

www.example.com:8444

I'm not sure I've covered all the changes and interactions the above suggestions will affect, but they'll get you closer to a working solution. Try to get the external redirect working first (perhaps pointing it google.com as a test), then worry about the 'proxy to back-end' function.

Jim

[krisl]

Thanks for the quick response.

I tried adding [L] to the first rule, so that now says:
RewriteRule ^/(.*)$ [%{SERVER_NAME}:8444...] [R,L]

But what happens now is that the page has redirected to the https page but the actual login page that is to be served from tomcat is not seen. I just see a directory listing of the apache server Doc root.

I need the next rule to kick in and proxy "/" to serve the jsp page from the internal tomcat server.

I tried to rewrite the first rule to:
RewriteRule ^/$ [%{SERVER_NAME}:8444...] [R,L]

so that the first / redirects first to https and then the following rule
will proxy login.do to the tomcat server.

RewriteCond %{HTTP_HOST} (.*)\.example\.com
RewriteRule ^.*:8444/login.do$ ${sdmap:%1}/subDomainLogin.do?subdomain=%1 [P,L]

But what happens now is that I get a 404 (page not found) for
[subdomain.example.com:8444...]

Thats probably because its looking for this login jsp page in the frint end apache server where this doesnt exist. Also the rewrite log shows that the 2nd rewite rule on login.do never kicked in, now because of the [L] flag.

Any help will be highly appreciated!

[krisl]

After further investigating, I am wondering if RewriteRule works on https requests at all?

I am testing with only one rule:
RewriteRule . [localhost:8443...] [P,L]

Now, in the browser, when I navigate to [subdomain0.example.com:8444...] I see listing of the root directory in apache, but no movement in rewrite.log.

Doesnt this imply that my https:// url is not qualifying for the rewrite rule?

[krisl]

Not sure if others have run into the same problem, or if it was just me not looking closely.

Anyhow, I noticed that that there was another congf file being included that had the SSL VirtualHost set up. Once I moved my rewrite rules into that VirtualHost, everything worked out fine.