无法通过nginx位置和代理通行证访问Glassfish4管理控制台

Question

Folks，

我们有一个在Glassfish4下运行的java应用程序。我想通过在防火墙级别关闭4848并通过nginx中的位置指令访问它(同时将SSL卸载到nginx(来禁用对Glassfish管理服务器的直接访问。

打开asadmin enable-secure-admin后，我可以通过https://foo.domain.com:4848并正常管理。

但是，当我通过asadmin disable-secure-admin禁用安全管理并使用以下位置块访问时

    # Reverse proxy to access Glassfish Admin server
    location /Glassfish {
    proxy_set_header               Host $host;
      proxy_set_header               X-Real-IP $remote_addr;
      proxy_set_header               X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header               X-Forwarded-Proto $scheme;
      proxy_max_temp_file_size      0;
      client_max_body_size           10m;
      client_body_buffer_size        128k;
      proxy_send_timeout             90;
      proxy_read_timeout             90;
      proxy_buffering                off;
      proxy_buffer_size              4k;
      proxy_buffers                  4 32k;
      proxy_busy_buffers_size        64k;
      proxy_temp_file_write_size     64k;
      proxy_pass                            http://127.0.0.1:4848;
    }

alahttps://foo.domain.com/Glassfish我得到一个空白屏幕，在nginx错误日志中我能找到的唯一参考是

2015/10/05 09:13:57 [error] 29429#0: *157 open() "/usr/share/nginx/html/resource/community-theme/images/login-product_name_open.png" failed (2: No such file or directory), client: 104.17.0.4, server: foo.domain.com, request: "GET /resource/community-theme/images/login-product_name_open.png HTTP/1.1", host: "foo.domain.com", referrer: "https://foo.domain.com/Glassfish"

阅读文档和在网上我确实看到了：

必须启用安全管理员才能远程访问DAS

我想做的事情根本不可能吗？

编辑：下面是完整的nginx配置。

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /var/log/nginx/access.log  main;
    #sendfile            off;
    tcp_nopush          on;
    tcp_nodelay         off;
    #keepalive_timeout   65;
    types_hash_max_size 2048;
    # Default HTTP server on 80 port
    server {
        listen       192.168.1.10:80 default_server;
        #listen       [::]:80 default_server;
        server_name  foo-dev.domain.com;
        return 301 https://$host$request_uri;
    }
    # Default HTTPS server on 443 port
    server {
      listen 443;
      server_name foo-dev.domain.com;
      ssl_certificate           /etc/ssl/certs/foo-dev.domain.com.crt;
      ssl_certificate_key       /etc/ssl/certs/foo-dev.domain.com.key;
      ssl on;
      ssl_session_cache  builtin:1000  shared:SSL:10m;
      ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
      ssl_prefer_server_ciphers on;
      access_log            /var/log/nginx/foo-dev.domain.com.access.ssl.log;
        # Reverse proxy access to foo hospitality service implementation at BC back-end
        location /AppEndPoint {
          proxy_set_header               Host $host;
          proxy_set_header               X-Real-IP $remote_addr;
          proxy_set_header               X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header               X-Forwarded-Proto $scheme;
          proxy_max_temp_file_size      0;
          client_max_body_size           10m;
          client_body_buffer_size        128k;
          proxy_send_timeout             90;
          proxy_read_timeout             90;
          proxy_buffering                off;
          proxy_buffer_size              4k;
          proxy_buffers                  4 32k;
          proxy_busy_buffers_size        64k;
          proxy_temp_file_write_size     64k;
          proxy_pass                            http://foo-dev.domain.com:8080;
        }
        # Reverse proxy to access Glassfish Admin server
         location /Glassfish {
        proxy_set_header               Host $host;
      proxy_set_header               X-Real-IP $remote_addr;
      proxy_set_header               X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header               X-Forwarded-Proto $scheme;
      proxy_max_temp_file_size      0;
      client_max_body_size           10m;
      client_body_buffer_size        128k;
      proxy_send_timeout             90;
      proxy_read_timeout             90;
      proxy_buffering                off;
      proxy_buffer_size              4k;
      proxy_buffers                  4 32k;
      proxy_busy_buffers_size        64k;
      proxy_temp_file_write_size     64k;
      proxy_pass                            http://127.0.0.1:4848;
    }
        # Reverse proxy access to all processed servers by both client and server component
        location /messages {
          alias /integration/archive/app-messages/;
          autoindex on;
          #auth_basic "Integration Team Login";
          #auth_basic_user_file /integration/archive/app-messages/requests/.htpasswd;
        }
   }
}

/AppEndPoint位置块是正常工作的Glassfish应用程序服务器，只是/Glassfish位置块给我带来了麻烦。

Answer 1

好的，谢谢你的编辑。

试用：

listen: 443 ssl;

顺便说一句，Mozilla提供了一个很好的配置帮助：SSL生成器

如果您将请求转发到location /Glassfish，则必须修剪请求url以删除/Glassfish。重写学分。

顺便问一下，您的其余配置在SSL上工作吗？

Answer 2

仅代理中的更改为https传递http

location / {
proxy_pass https://localhost:4848;
#proxy_http_version 1.1;
#proxy_set_header Upgrade $http_upgrade;
#proxy_set_header Connection 'upgrade';
#proxy_set_header Host $host;
#proxy_cache_bypass $http_upgrade;
}

Answer 3

正如您所问的，我想您在使用nginx访问Glassfish管理控制台时遇到了问题。然而，我分享了Glassfish服务器的整个nginx.conf文件的示例。请注意，位置"/admin"的"proxy_pass"指令应为https，因为对于使用https访问管理控制台的glassfish来说，这是强制性的。

可能导致您看不到管理控制台的一个原因是，当您访问该页面时，资源没有正确加载。您可以使用首选浏览器的开发人员选项验证不同加载的资源，以查看生成的URL；什么可以向您展示解决方案的一部分。

有了这个配置，您应该能够访问glassfish的两个部分，主控制台和管理控制台页面。如果您没有DNS服务器，您可以使用服务器IP进行访问。使用的SSL证书作为自签名仅用于测试目的，请考虑使用有效的SSL证书，如Let's Encrypt或由有效的CA生成。

例如：

• http://192.168.1.15/glassfish
• http://192.168.1.15/admin

https重定向应该可以工作，最后您将被重定向到：

• https://192.168.1.15/glassfish
• https://192.168.1.15/admin

glassfish-ngix.conf

upstream glassfish {
    server 127.0.0.1:8080;
}
upstream glassfishadmin {
    server 127.0.0.1:4848;
}
server {
    listen 80;
    return 301 https://$host$request_uri;
}
    
server {
    listen 443 ssl http2;
    set $glassfish_server glassfish;
    set $glassfish_admin glassfishadmin;
    server_name mydomain.com;
    # sample site certificates
    ssl_certificate  /etc/nginx/server.crt;
    ssl_certificate_key  /etc/nginx/server.key;
    ssl_trusted_certificate /etc/nginx/server.crt;
    location /glassfish {
        charset utf-8;
        # limits
        client_max_body_size 100m;
        proxy_read_timeout 600s;
        # buffers
        proxy_buffers 16 64k;
        proxy_buffer_size 128k;
        # gzip
        gzip on;
        gzip_min_length 1100;
        gzip_buffers 4 32k;
        gzip_types text/css text/less text/plain text/xml application/xml application/json application/javascript;
        gzip_vary on;
        proxy_redirect off;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://$glassfish_server/;
    }
    location ~* .(png|ico|gif|jpg|jpeg|css|js)$ {
        proxy_pass https://$glassfish_admin/$request_uri;
    }
    location /admin {
        proxy_connect_timeout       300;
        proxy_send_timeout          300;
        proxy_read_timeout          300;
        send_timeout                300;
        proxy_pass_request_headers on;
        proxy_no_cache $cookie_nocache  $arg_nocache$arg_comment;
        proxy_no_cache $http_pragma     $http_authorization;
        proxy_cache_bypass $cookie_nocache $arg_nocache $arg_comment;
        proxy_cache_bypass $http_pragma $http_authorization;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host:$server_port; #Very nb to add :$server_port here
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        add_header Access-Control-Allow-Origin *;
        proxy_set_header Access-Control-Allow-Origin *;
        proxy_pass https://$glassfish_admin/;
    }
}