|
I'm currently trying to connect CMIS Explorer (Android app) to Nuxeo DM 5.5. In my current setup, Nuxeo runs behind an SSO solution called LemonLDAP, acting as a reverse proxy. The SSO part works well - through mod_sso. The publicly accessible URL uses HTTPS. There's no service listening on plain HTTP. In order to CMIS clients to connect, I asked my SSO proxy to do just plain reverse-proxying (no authentication or redirection of any kind) on ^/nuxeo/atom/cmis.*. I also asked Nuxeo to stop using FORM_AUTH or PROXY_AUTH on such URLs, by adding a custom contribution. This part works well : curl -k "https://my.public.host/nuxeo/atom/cmis" answers with a bit of application/atomsvc+xml. But clients still don't work, and I read what's in the "atomsvc+xml". And there I found numerous URLs starting with http://my.public.host/... There's clearly no way it's going to work without https, but how could I explain Nuxeo not to publish plain HTTP URLs? |
|
|
|
|
|
The Nuxeo CMIS connector, based on OpenCMIS, doesn't take into account the There's an OpenCMIS ticket (CMIS-500) about properly taking into account the You may also try to use standard Tomcat Finally something that I think will always work is the Tomcat RemoteIpValve that you can add to your |
|
|
It is a shame that CMIS-500 has been closed without any resolution. Think I might just apply the XForwardedHeaders patch for out set-up.
(Apr 13 '12 at 10:38)
sradford
I believe the OpenCMIS 0.7.0 release includes the fix for CMIS-500, namely a new ProxyFilter that "can be used where the combination of the correct Apache reverse proxy config and Tomcat RemoteIpValve is not possible (no Apache reverse proxy, No Apache Tomcat)." It is not clear when Nuxeo will upgrade to this OpenCMIS release. Nevertheless, the next Nuxeo release is expected to be based on Tomcat 6.0.35 that includes RemoteIpValve. If you are using the Nuxeo Tomcat distribution, RemoteIpValve should be sufficient to solve this issue.
(Apr 13 '12 at 15:34)
ron
Nuxeo 5.6-SNAPSHOT will be upgraded to OpenCMIS 0.7.0 once it's released (which is soon).
(Apr 16 '12 at 01:49)
Florent Guillaume ♦♦
And btw current Nuxeo 5.6-SNAPSHOT is already using Tomcat 6.0.35.
(Apr 16 '12 at 01:50)
Florent Guillaume ♦♦
Would be great if the Nuxeo reverse proxy documentation was updated to describe the recommended Nuxeo CMIS reverse proxy configuration. This is especially true since this topic appears to be a popular one based on the number of views.
(Oct 14 '12 at 04:48)
ron
|
|
|
Ok. Long time no see. I just upgraded my Debian Squeeze test install to Nuxeo 5.6, which seems to come with openCmis 0.7.0 and Tomcat 6.0.35. Just as expected. Cool. My frontend Apache HTTP uses mod_proxy to do its work, and sets headers as follows : (the rest being done with a "ProxyPreserveHost" directive) Then on my Nuxeo host, I set up a Tomcat Valve looking like this : Until I comment this, Nuxeo refuses to start, without giving any clear error. If commented, it works, but then x-forwarded-proto isn't took into account (which sounds logical). Could there be something to install before being able to use that valve? From what grep/strings gives me, there's mention of RemoteIpValve in catalina.jar, so... |
|
|
For some reason, it finally worked without changing anything : Nuxeo accepted to start with the Valve directive, and the CMIS servlets answered with the right protocol. Just for the sake of completeness, if anyone needs to set this up as well : my Valve directive was in /var/lib/nuxeo/server/templates/common-base/conf/server.xml.nxftl (or else it would be deleted upon regeneration), and right after
(Dec 18 '12 at 17:34)
OlivierM
|
|
Just to skip the most obvious answers : my reverse-proxy configuration already specifies
RequestHeader append nuxeo-virtual-host "https://my.public.host/"Please use answers for answers and comment for comment. This is important for the community.