unable to load jira via AWS ALB

[sunil]

Hi,

We have an AWS ALB listerns on port 443 infront of jira and jira listens on port 8080. Able to login the jira via ALB but Dashboard.jspa i sunable to load . When i checked the catalina.out log i see a stuck thread is being recorded and from jira application log noticed Dashboard-Diagnotics has failed and below is the error snippet from jira application log

Need help here to fix this issue

2020-07-21 02:13:50,797+0000 http-nio-8080-exec-18 ERROR anonymous 133x18x1 11xxhu8 172.31.XX.XX,10.0.XX.XX /plugins/servlet/gadgets/dashboard-diagnostics [c.a.g.d.internal.diagnostics.DiagnosticsServlet] DIAGNOSTICS: FAILED
com.atlassian.gadgets.dashboard.internal.diagnostics.UrlSchemeMismatchException: Detected URL scheme, 'http', does not match expected scheme 'https'
at com.atlassian.gadgets.dashboard.internal.diagnostics.Diagnostics.checkExpectedScheme(Diagnostics.java:52)
at com.atlassian.gadgets.dashboard.internal.diagnostics.Diagnostics.check(Diagnostics.java:31)
at com.atlassian.gadgets.dashboard.internal.diagnostics.DiagnosticsServlet.executeDiagnostics(DiagnosticsServlet.java:82)
at com.atlassian.gadgets.dashboard.internal.diagnostics.DiagnosticsServlet.doPost(DiagnosticsServlet.java:58)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at com.atlassian.plugin.servlet.DelegatingPluginServlet.service(DelegatingPluginServlet.java:37)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at com.atlassian.plugin.servlet.ServletModuleContainerServlet.service(ServletModuleContainerServlet.java:45)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
... 48 filtered
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)
... 58 filtered
at com.atlassian.jira.security.JiraSecurityFilter.lambda$doFilter$0(JiraSecurityFilter.java:66)
... 1 filtered
at com.atlassian.jira.security.JiraSecurityFilter.doFilter(JiraSecurityFilter.java:64)
... 36 filtered
at com.atlassian.jira.servermetrics.CorrelationIdPopulatorFilter.doFilter(CorrelationIdPopulatorFilter.java:30)
... 10 filtered
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)
... 4 filtered
at com.atlassian.web.servlet.plugin.LocationCleanerFilter.doFilter(LocationCleanerFilter.java:36)
... 26 filtered
at com.atlassian.jira.servermetrics.MetricsCollectorFilter.doFilter(MetricsCollectorFilter.java:25)
... 25 filtered
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)

[Italo Qualisoni [e-Core]]

Hello,

You will need to update your server.xml file to include these parameters in the connector that is mapped in your ALB ( port 8080 ) and to this change take place you will need to restart the application; See more details about the changes you need to do in your connector here: https://confluence.atlassian.com/jirakb/integrate-jira-jira-data-center-with-aws-elb-942841242.html

proxyName="yourdnsdomain.com" proxyPort="443" scheme="https" secure="true"

Also you might be with a blank screen because of the health check of your ALB, if the application doesn't respond the load balance will think the application is not ready to serve request, so I would also double check that.

[sunil]

@Italo Qualisoni [e-Core] 

Thanks for the information, we have updated the ALB details in server.xml as below

But still i see a balnk page when i hit JIRA URL in browser on ALB and we are using AWS Route 53 as DNS of ALB and have same DNS name in server.xml.

Could you help us on how configure the JIRA with ALB details in server.xml to access using ALB in browser

<Connector port="8080" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"
maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false"
maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443"
acceptCount="100" disableUploadTimeout="true" bindOnInit="false"/>

<Connector port="8084" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"
maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false" maxHttpHeaderSize="8192"
protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443" acceptCount="100" disableUploadTimeout="true"
proxyName="XXXXX" proxyPort="443" scheme="https" secure="false" bindOnInit="false" />

Thanks,

KSunil

[Italo Qualisoni [e-Core]]

Hi @sunil ,

It seems that your application is listening in both 8080 and 8084.

Since you added the parameters in 8084, you should map your load balancer to traffic from 443 to 8084.

proxyName="XXXXX" proxyPort="443" scheme="https" 

Something important, you need to change the secure to true in your 8084 connector, currently it's set as false.

This change requires you to restart the application to take effect.

Check the logs to see if that error is gone after this change and let me know how it goes.

[sunil]

Hi @Italo Qualisoni [e-Core] ,

Thanks for the information, would like to check with you, do i require to make jira SSL (certificate) to implement the above configuration .

Meanwhile i will try to implement the above settings

Thanks,

KSunil

[Italo Qualisoni [e-Core]]

No, in your case the certificate will be only in your ALB;

Try the changes to set secure equals true in your connector that uses port 8084 and let us know

[sunil]

Hi @Italo Qualisoni [e-Core] 

I have updated the jira to run on both ports 8080 and 8084 , 8084 (8084 is configured in LB) . After restart jira, able to load login page but once i clicked on login button page took 2 minutes and then shows empty page. I noticed the below error in the jira-application.log

2020-09-08 03:46:14,705+0000 http-nio-8080-exec-18 ERROR anonymous 226x18x1 tu08v7 X.X.X.X,X.X.X.X /plugins/servlet/gadgets/dashboard-diagnostics [c.a.g.d.internal.diagnostics.DiagnosticsServlet] DIAGNOSTICS: FAILED
com.atlassian.gadgets.dashboard.internal.diagnostics.UrlSchemeMismatchException: Detected URL scheme, 'http', does not match expected scheme 'https'
at com.atlassian.gadgets.dashboard.internal.diagnostics.Diagnostics.checkExpectedScheme(Diagnostics.java:52)
at com.atlassian.gadgets.dashboard.internal.diagnostics.Diagnostics.check(Diagnostics.java:31)
at com.atlassian.gadgets.dashboard.internal.diagnostics.DiagnosticsServlet.executeDiagnostics(DiagnosticsServlet.java:82)
at com.atlassian.gadgets.dashboard.internal.diagnostics.DiagnosticsServlet.doPost(DiagnosticsServlet.java:58)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at com.atlassian.plugin.servlet.DelegatingPluginServlet.service(DelegatingPluginServlet.java:37)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at com.atlassian.plugin.servlet.ServletModuleContainerServlet.service(ServletModuleContainerServlet.java:45)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
... 48 filtered
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)
... 58 filtered
at com.atlassian.jira.security.JiraSecurityFilter.lambda$doFilter$0(JiraSecurityFilter.java:66)
... 1 filtered
at com.atlassian.jira.security.JiraSecurityFilter.doFilter(JiraSecurityFilter.java:64)
... 36 filtered
at com.atlassian.jira.servermetrics.CorrelationIdPopulatorFilter.doFilter(CorrelationIdPopulatorFilter.java:30)
... 10 filtered
at com.atlassian.web.servlet.plugin.request.RedirectInterceptingFilter.doFilter(RedirectInterceptingFilter.java:21)
... 4 filtered
at com.atlassian.web.servlet.plugin.LocationCleanerFilter.doFilter(LocationCleanerFilter.java:36)
... 26 filtered
at com.atlassian.jira.servermetrics.MetricsCollectorFilter.doFilter(MetricsCollectorFilter.java:25)
... 25 filtered
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)

Thanks,

KSunil

[Italo Qualisoni [e-Core]]

Hi @sunil ,

Did you change the secure attribute to true in your connector that uses ELB 8084?

<Connector port="8084" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"
maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false" maxHttpHeaderSize="8192"
protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443" acceptCount="100" disableUploadTimeout="true"
proxyName="XXXXX" proxyPort="443" scheme="https" secure="true" bindOnInit="false" />

[sunil]

Hi @Italo Qualisoni [e-Core] 

Please find the below connector port to configure to use LB in server.xml for jira

<Connector port="8084" relaxedPathChars="[]|" relaxedQueryChars="[]|{}^&#x5c;&#x60;&quot;&lt;&gt;"
maxThreads="150" minSpareThreads="25" connectionTimeout="20000" enableLookups="false"
maxHttpHeaderSize="8192" protocol="HTTP/1.1" useBodyEncodingForURI="true" redirectPort="8443"
acceptCount="100" disableUploadTimeout="true" bindOnInit="false" secure="true" scheme="https"
proxyName="X.X.X.X" proxyPort="443"/>

Please need your help to fix this issue and let me know for any more information required.

[Italo Qualisoni [e-Core]]

@sunil ,

Your connector looks correct, after you change this file you must restart the application to changes take effect.

Does this error appears in the logs when you access https://X.X.X.X ?( where the X.X.X.X would be your DNS for your ELB)?

[Samia Rahman]

Hi I am using below documents to integrate aws alb. in the server I am getting attached error. How do I update the server.xml file?
Integrate Jira/Jira Data Center with AWS ELB | Jira | Atlassian Documentation