Enable redirecting http traffic to secured upstream servers

Question

Enable redirecting http traffic to secured upstream servers

Closed this issue 9 years ago · 7 comments

Currently only http upstream servers can be used. This will require to also change the external interface configuration form in MI's cloud views and atmosphere's REST API to convey the additional attribute saying if the upstream server is secured with https.

Answer 1 · 2015-04-17T10:16:59.000Z

With @dharezlak we performed test where https->proxy->https->vm communication was established.

Redirus is ready for such change. Options capability can be used to distinguish if http or https should be used in proxy_pass directive. The only thing needed here is to change templates.

Atmosphere on the other hand need to be changed to support this feature. Boolean value should be added into Port Mapping Template (e.g. upstream_https) and this value should be converted into option while sending request into Redirus.

Answer 2 · 2015-07-16T12:16:23.000Z

@nowakowski, @tbartynski this task priority should be increased. In plgrid we have a situation where https->https communication should be established.

Another solution of the problem would be to:

remove https/https PortMappingTemplate type, only http OR https
redirus will establish http->http or https->https communication.

What is your opinion?

Answer 3 · 2015-07-16T12:35:11.000Z

Can we establish https->https without triggering a MIM-type situation?

Answer 4 · 2015-07-16T12:36:15.000Z

Yeap, I was able to establish such connection before creating this issue. To be 100% sure we can recreate such situation on Monday 😄

Answer 5 · 2015-07-16T12:39:43.000Z

That's good news. I like the idea of removing HTTP and HTTPS; IMHO this option never made much sense. :)

Answer 6 · 2015-07-16T12:54:07.000Z

I have mixed filings about it. On one hand you are right, for user it is quite strange that https->http connections are created. On the other hand https->http is much faster than https->https and we can treat inter tenant communication as "safe".

Answer 7 · 2015-07-16T14:17:08.000Z

@mkasztelnik I fully agree; what I was trying to say is that it's weird to have both an HTTP and an HTTPS redirection to an application service (you'll typically want one or the other); hence this menu option is confusing and could be removed.