How to setup IIS 10 Reverse Proxy between self hosted Jira servers and cloud applications

[Alfredo Lagrosa]

Can you help us configure our (Windows Server 2016) IIS 10 reverse proxy to work with our cloud applications to connect to my self hosted Jira servers through https?

Specifically, we are trying setup an application link for Smartsheet for Jira v7.9.2.

The Smartsheet for Jira application is receiving the following error message when trying to connect:

OAuth signature rejected. The public key may not match the value in JIRA or your reverse proxy settings may be incorrect. Please verify that the Public Key in your JIRA Application Link matches the value in your Smartsheet for JIRA Host listing. Also see the following guide for proxy troubleshooting actions: https://confluence.atlassian.com/display/APPLINKS/OAuth+troubleshooting+guide#OAuthtroubleshootingguide-OAuthsignaturerejected

We have followed all available online documentation, but, we can not get past the error message above.

On our IIS 10 reverse proxy server, the URL Rewrite inbound rule rewrites pattern's matching (.*) to https://myjira/{R:1}

Allowed Server Variables:
ORIGINAL_HOST local

The URL Rewrite outbound rule has two preconditions:

"IsHTML"
Using: Regular Expressions
Logical grouping: Match All
Input: {RESPONSE_CONTENT_TYPE},
Check if input string: Matches the Pattern,
Pattern: ^text/html
checked box: Ignore case

Match
Matching Scope: Response
Match the Content within: A
Content: Matches the Pattern
Using: Wildcards
Pattern: https://myjira/*
checked box: Ignore case

And "IsRedirection" with
Using: Regular Expressions
Logical grouping: Match All
Input: {RESPONSE_STATUS},
Check if input string: Matches the Pattern,
Pattern: 3\d\d
checked box: Ignore case

The Outbound rule is where the reverse proxy seems to fail.

For the Precondtion "IsHTML"
Matching scope: Response
Match the content within: A
Content: Matches the pattern
Using: Wildcards
Pattern: https://myjira/*

Action
Action type: Rewrite
Action properties: https://publicjira.mycompany.com/{R:1}
checked box: Stop processing of subsequent rules

Smartsheet support says their error log indicates the response they are receiving, https://myjira, is not the name as our public facing url, https://publicjira.mycompany.com. Thus, the connection fails.

Thank You!

AL

[Alfredo Lagrosa]

I tried applying recommendations from the following web links, but, the Smartsheet connector cannot connect:

https://help.smartsheet.com/articles/2476656-jira-connector-firewall-setup-troubleshoot

https://confluence.atlassian.com/kb/proxying-atlassian-server-applications-with-microsoft-internet-information-services-iis-833931378.html

https://confluence.atlassian.com/display/APPLINKS/OAuth+troubleshooting+guide#OAuthtroubleshootingguide-OAuthsignaturerejected

https://confluence.atlassian.com/kb/reverse-proxy-and-application-link-troubleshooting-guide-719095279.html:

https://blogs.msdn.microsoft.com/friis/2016/08/25/iis-with-url-rewrite-as-a-reverse-proxy-part-2-dealing-with-500-52-status-codes/

https://docs.microsoft.com/en-us/iis/extensions/url-rewrite-module/modifying-http-response-headers