HTTP_X_FORWARDED_PROTO is probably missing, resulting in bad origin address

[Lukas M]

HTTP_X_FORWARDED_PROTO is probably missing or is not set correctly ( at least this is working for Horizon ), resulting in bad origin address when using Reverse Proxy and SSO.

Notice the redirect here: `https://openstack.example.com:5000/v3/auth/OS-FEDERATION/websso/openid?origin=https://skyline.example.com:None/api/openstack/skyline/api/v1/websso`, port is `None`

This can be breaking for Keystone, see the config snippet
```
[federation]
trusted_dashboard = https://skyline.example.com:None/api/openstack/skyline/api/v1/websso
```

Thanks

[Shuai Qian (iauhsnaiq)]

add port in the url
[federation]
trusted_dashboard = https://<openstack_ip>:9999/api/openstack/skyline/api/v1/websso

[Lukas M (muhaha)]

No, its happening before the Keystone authorization ( I can see in Keystone logs, that https://skyline.example.com:None/api/openstack/skyline/api/v1/websso is not added to trusted dashboards ), Nginx or Gunicorn does not handle reverse proxy a probably HTTP_X_FORWARDED_PROTO is not respected. Thats why its set to None, thus origin URL is generated like :None port. Just like Django does this https://code.djangoproject.com/ticket/27961#comment:3

[conna (yangshaoxue)]

Please provide your skyline configuration file and skyline startup command (protocol and port number)

Please check the skyline image version, We fixed a similar bug: https://review.opendev.org/c/openstack/skyline-apiserver/+/879465

[Lukas M (muhaha)]

Thanks, seems that https://review.opendev.org/c/openstack/skyline-apiserver/+/879465 solved my problem.

[Lukas M (muhaha)]

Is possible to backport https://review.opendev.org/c/openstack/skyline-apiserver/+/879465 to 2023.1 ?

[conna (yangshaoxue)]

You can pull the latest image

[Lukas M (muhaha)]

I am using koll-ansible deployment.