POST requests 500 - Nginx Kerberos SSO SSL Alfresco 201911/6.2

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

mmagowski

I probably find a bug in alfresco 2019.11 which stopped us from upgrading to 6.2. 

We have problem on clean alfresco base on docker-compose configuration. 

Problem exists in: 2019.11 with SSO turn on. All post request in system are rejected and have status 500. When you turn off SSO you can send POST requests, for example upload a file.

Our configuration: 2019.11, nginx, docker-compose, SSO, SSL in nginx, Kerberos, AD.

We handle the issue...by not using the newest alfresco We don't have any problems with clean alfresco and 201901 with same configuration. We were testing this in simple fashion, just simply changing .env file for docker-compose and docker files. We not changing anything in configuration, only changing version for alfresco repository and alfresco share.

Nginx configuration:

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    sendfile on;

    server {
        listen 443 ssl;

        client_max_body_size 0;
  
        set  $allowOriginSite *;
       proxy_pass_request_headers on;
       proxy_pass_header Set-Cookie;
        
        ssl_certificate     /etc/nginx/client.crt;
        ssl_certificate_key /etc/nginx/client.key;
        ssl_ciphers         EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!RC4:!MD5:!DES;
        ssl_protocols       TLSv1.1 TLSv1.2;
    
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        large_client_header_buffers  4 32k;

        # External settings, do not remove
        #ENV_ACCESS_LOG
        error_page 497 https://$host:$server_port$request_uri;

        proxy_set_header Host            $host:$server_port;
        proxy_set_header X-Real-IP       $remote_addr;
        proxy_redirect http:// https://;

        # Protect access to SOLR APIs
        location ~ ^(/.*/service/api/solr/.*)$ {return 403;}
        location ~ ^(/.*/s/api/solr/.*)$ {return 403;}
        location ~ ^(/.*/wcservice/api/solr/.*)$ {return 403;}
        location ~ ^(/.*/wcs/api/solr/.*)$ {return 403;}

        location ~ ^(/.*/proxy/alfresco/api/solr/.*)$ {return 403 ;}
        location ~ ^(/.*/-default-/proxy/alfresco/api/.*)$ {return 403;}

        # Alfresco Repository
        location /alfresco/ {
            proxy_pass http://alfresco:8080;
        }

        # SOLR Web Console (Master)
        location /solr/ {
            proxy_pass http://solr6:8983;

            # Basic authentication
            auth_basic "Solr web console";
            auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd;
        }

        # Alfresco Share Web App
        location /share/ {
            proxy_pass http://share:8080;
        }

        # Alfresco Content App
        location / {
            proxy_pass http://alfresco:8080;
        }
    }
}

EddieMay

Hi @mmagowski,

Currently investigating this issue. Will update when I have some news.