authorization Denied when passing through ngix

[Zhao11116]

Hi there,

Sorry to interrupt; But we faced an issue here, would you please help me?

Here is the issue: we faced authorization Denied issue when we used nginx to pass through. However, if we do not use nginx, everything works fine.

Thanks a lot for your help.

Thanks,
zhao

[t984447]

Ive have the same issue and Ive been reading around (#65) but I never even get any auth prompt.

Even werider is that I know that I had it working little over a week ago.
I did notice that the container was updated 5 days ago
I am trying to find out what was updated and what version I have.

My setup running on a Synology (DSM7)
Docker version EJBCA-CE - EJBCA 7.10.0.1
Docker MySQL - 8.0.31-1.el8

Neither via proxy or direct connection works.

[t984447]

According to the EJBCA 7.10.0.1 Upgrade Notes there was some mention of Cert auth.

More Fine-grained Access Rules for RA GUI
The access rules /ca_functionality/use_username and /ca_functionality/use_approval_request_id have been added and correspond to the pages with the same name in the EJBCA RA UI. These access rules are added automatically to all roles with /ca_functionality/create_certificate access. For more information, see Access Rules and RA Administrator Access Rules.

Just checked my logs;
The container itself is EJBCA 7.10.0.1, however no release date.

2022-11-11 07:23:55,929+0000 INFO [org.ejbca.core.ejb.StartupSingletonBean] (ServerService Thread Pool -- 91) Init, EJBCA 7.10.0.1 Community (a3751951068a789517bb8b2a7f738cdf00cb0df3) startup.

Presuming that it was updated 5 days ago I might have been on the prior version a week ago and maybe my Synology auto-updates?

[primetomas]

I just tried with the latest container and it worked for me. You may have to open up a new private tab (or restart the browser) after installing the superadmin certificate, otherwise the browser may "cache" that a certificate was not used.

[primetomas]

If it works without nginx in front, then it's a thing with the nginx configuration. Depending on how you configure it Nginx.
@Zhao11116 : you don't mention if you are using plain software with WildFly or the Container. But the container documentation have information how to proxy certificates either when using an AJP connector or when using HTTP pass-through. Did you consider SSL_CLIENT_CERT when adding the Nginx proxy?