K8s Ingress - Login issue

[kTipSSIoYv]

I followed this documentation to setup SSL termination on the NLB ingress. I'm using Nginx controller.

But the login pages keeps asking for credentials and doesn't succeed. I see the following in the logs. After entering credentials the request for GET /?timeout=false is http (302) and then its redirected to https (304). As a result login process doesn't complete at all.

Log shows only 304 request.

Any idea why and how can I fix this? I'm just testing this.

100.96.xx.xx - - [05/Aug/2022:07:16:47 +0000] "GET /packs/bg-login.png HTTP/1.1" 404 728
100.96.xx.xx - - [05/Aug/2022:07:16:47 +0000] "GET /assets/favicon-6ca95f7b93eeb006088db7dd238353e62eb9ad976446654600ad6d42e2d62ae2.ico HTTP/1.1" 200 24838
100.96.xx.xx - - [05/Aug/2022:07:16:58 +0000] "POST /dashboard/authenticate?button=login HTTP/1.1" 200 61
100.96.xx.xx - - [05/Aug/2022:07:16:59 +0000] "GET /ems_infra/show_list HTTP/1.1" 302 113
100.96.xx.xx - - [05/Aug/2022:07:16:59 +0000] "GET /?timeout=false HTTP/1.1" 304 -
100.96.xx.xx - - [05/Aug/2022:07:17:00 +0000] "GET /packs/runtime-17e6ab38b1094a13ecb4.js.map HTTP/1.1" 200 8275

[bdunne]

Which authentication method are you using? In the CR what are the values for:

  enableApplicationLocalLogin
  enableSSO
  httpdAuthenticationType

[kTipSSIoYv]

@bdunne Its all set to default value. What should it be in order to resolve the issue?

  enableApplicationLocalLogin: true
  httpdAuthenticationType: internal
  enableSSO: false

[kTipSSIoYv]

@bdunne I tried to change it to external just to test. But it seems the httpd pod doesn't have these modules. How do you install these modules if needed?

LoadModule authnz_pam_module            modules/mod_authnz_pam.so
LoadModule intercept_form_submit_module modules/mod_intercept_form_submit.so
LoadModule lookup_identity_module       modules/mod_lookup_identity.so

kubectl logs -f httpd-f4d6c589b-8vwls

httpd: Syntax error on line 355 of /etc/httpd/conf/httpd.conf: Syntax error on line 3 of /etc/httpd/conf.d/authentication.conf: Cannot load modules/mod_authnz_pam.so into server: /etc/httpd/modules/mod_authnz_pam.so: cannot open shared object file: No such file or directory

[kTipSSIoYv]

@Fryguy @bdunne Any idea how to resolve the above error and the authentication issue?

[Fryguy]

What kind of external auth are you trying to use? The only supported one with the default httpd pod is OIDC. If you want anything else you need to use the httpd-init pod.

[kTipSSIoYv]

@Fryguy I tried using httpd-init and bull still there is a redirect after login,

Also the httpd-init doesn't start httpd service by itself, as a result pod health check fails.

[bdunne]

I think you need to run https://github.com/ManageIQ/httpd_configmap_generator in order to generate the config for the httpd-init container to run

[kTipSSIoYv]

@bdunne @Fryguy I'm testing http login on docker monolithic version and its not working either.

I've disabled 443 and enabled port 80 on httpd. After entering credentials it returns back to login page.,

/authenticate
/dashboard/show
/?timeout=false

There is no internal redirect. Why is it http authentication not working?

[karkul]

Had anybody resolve this issue?