IIS Proxy with SSL

[Oskar]

Hi,

I have setup JIRA and Confluence with URL context /jira and /wiki respecively.

IIS act as reverse proxy with URL redirect so that any http requests are redirected to https.

It also rewrites the URL so it is presented without the port when going to url.domain.local/jira with a rewrite URL of http://url.domain.local:8080/{R:1}.

Going to http;//url.domain.local/jira redirects to https://url.domain.local/jira, however going to http://url.domain.local:8080/jira does not redirect to https://url.domain.local/jira.

Even if I setup a IIS redirect which forwards all requests to ie Google.com it still doesn't do it when entering http://url.domain.local:8080/jira, but everything else does. It feels lika Java is hijacking this URL. Is there any way to have this URL redirect to https also?

I found this KB but not sure if this would solve my situation?

[JP _AC Bielefeld Leader_]

Hi Oskar,

this is because your IIS server is NOT listening on port 8080 but on port 80/443. Jira listens on port 8080. So the redirection for port 8080 in IIS is never triggered.

Best

JP

[Oskar]

Hi JP,

aah, of course! How would I go about to solve this? Adding 8080 to IIS will only cause conflict with Tomcat and using the Tomcat HTTPS redirection (security-constraint in web.xml) was working before I added IIS to the mix, but not anymore (and is recommended to be turned off when using a proxy).

I don't want anyone to "stumble" onto :8080 and it doesn't redirect to HTTPS.

Any ideas are appriciated.

Cheers,
Oskar

[JP _AC Bielefeld Leader_]

Hi Oskar,

configure your IIS to listen to 8080 (Jira) and 8090 (Confluence). Configure Jira to listen to eg.8081 and Confluence to 8091.

IIS should be configured to proxy to Jira using 8081 and Confluence using 8091. Then configure ISS to redirect 8080 & 8090 to the default URLs  https://url.domain.local/jira and  https://url.domain.local/confluence.

Best

JP

[Oskar]

Hey JP,

won't that just move the "issue" so that 8081 is "exposed" as http instead? I would want all traffic to be https. Or maybe I misunderstood you.

Kind regards,
Oskar