Home / server / Questions / 523361
Accepted
Tode
Asked: 2013-07-16 03:11:25 +0800 CST

Lotus Domino 8.5.3FP2 behind pound Reverse proxy: Wrong redirect

  • 772

I have a problem with the following setup:

  • A pound reverse proxy faces the internet with port 443.
  • The pound reverse proxy is configured to redirect to the internal server
  • The (internal) domino server only has port 80 enabled.
  • The homepage of the domino is a iwaredir.nsf created from the template iwaredir.ntf
  • Session based login is enabled with a domcfg.nsf- Database in place (no custimization except another logo)

When you open the external url (e.g. h11ps://webmail.mycompany.org) of the proxy, the configured login- page from domcfg is presented. the user logs in, and the next page, that is presented is: h11p://webmail.mycompany.org/iwaredir.nsf

As you can see, the protocol is exchanged by the server- login- page, and port 80 is not configured on the pound, that lets the request fail (of course)

If the user uses the browser's back- button, then the url changes to h11ps://webmail.mycompany.org. This time the user is already authenticated and is directly forwarded to h11ps://webmail.mycompany.org/iwaredir.nsf and everything works like a charme

Same configuration with no changes to domcfg.nsf, iwaredir.nsf and pound worked a fiew weeks ago, but suddenly stopped (of course with nobody having modified anything...)

So my question is: Why does the default- login- form of domino switch the protocol for the url to redirect to (found as relative path in document- field "RedirectTo") from https to http?

I found out, that everything works, if I use a JavaScript to write the full URL in the RedirectTo- Field on the login- form. But this is only a workaround, and I want to find out the reason.

Any idea to debug this is appreciated.

reverse-proxy

1 Answers

  1. Best Answer

    I could solve the problem by myself. It was neither a Lotus Domino Configuration issue nor a pound- configuration issue.

    The reason was a change on a DNS- server. The pound- server could not resolve its own name into an IP- address anymore. Therefor it did not rewrite the "wrong" addresses delivered by domino into the right ones.

    Adding the hostname of the reverse proxy to its own /etc/hosts and restarting pound resolved the issue.

    • 0