login hangs when accessed through an nginx proxy

General discussion about Zimbra Desktop.
abatie
Advanced member
Advanced member
Posts: 59
Joined: Thu Aug 07, 2014 12:02 pm

login hangs when accessed through an nginx proxy

Postby abatie » Thu Oct 23, 2014 8:20 pm

We finally got our cluster upgraded to 8.5 last night, though this problem was occurring with 7.2.7 I believe as well: we have an nginx proxy in front of our cluster to help with mail migrations, but for http/https, it's a simple proxy to zimbra:


server {
    listen 80;
    server_name mail.cmug.com mail-dev-cmug.peak.org;


    location / {
        proxy_pass http://zmail.peak.org;
    }
}


When a user logs in on the web login, it hangs at "Loading ..." until you click on the "Switch to the Standard (HTML) version" link, at which point everything works fine.  This does not occur when going directly to Zimbra.


The last lines in the access log on the relevant store machine before the hang:


207.55.17.40 - - [24/Oct/2014:01:13:23 +0000] "POST /service/soap/BatchRequest HTTP/1.0" 403 309 "http://mail-dev-cmug.peak.org/zimbra/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 0
207.55.17.40 - - [24/Oct/2014:01:13:23 +0000] "POST /service/soap/BatchRequest HTTP/1.0" 403 309 "http://mail-dev-cmug.peak.org/zimbra/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 0
207.55.17.40 - - [24/Oct/2014:01:13:23 +0000] "GET /zimbra/skins/_base/logos/AppBanner_white.png?v=140828194005 HTTP/1.0" 200 - "http://mail-dev-cmug.peak.org/zimbra/css/images,common,dwt,msgview,login,zm,spellcheck,skin.css?v=140828194005&debug=false&skin=beach&locale=en_US" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 6
207.55.17.40 - - [24/Oct/2014:01:13:23 +0000] "GET /zimbra/js/Startup2_all.js.zgz?v=140828194005 HTTP/1.0" 200 114177 "http://mail-dev-cmug.peak.org/zimbra/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 7
207.55.17.40 - - [24/Oct/2014:01:13:23 +0000] "GET /zimbra/img/dwt.png?v=140828194005 HTTP/1.0" 200 - "http://mail-dev-cmug.peak.org/zimbra/css/images,common,dwt,msgview,login,zm,spellcheck,skin.css?v=140828194005&debug=false&skin=beach&locale=en_US" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 6


When I switch to HTML:


207.55.17.40 - - [24/Oct/2014:01:13:29 +0000] "GET /zimbra/?client=standard HTTP/1.0" 302 - "http://mail-dev-cmug.peak.org/zimbra/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 44
207.55.17.40 - - [24/Oct/2014:01:13:29 +0000] "GET /zimbra/h/search?mesg=welcome&init=true HTTP/1.0" 200 - "http://mail-dev-cmug.peak.org/zimbra/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 365


The 403 Forbidden errors on the soap request seem suspicious, but I'm not sure where to see what it's unhappy about though...


When I go directly, the soap requests are happy and things proceed fine:


69.59.192.10 - - [24/Oct/2014:01:17:34 +0000] "POST /service/soap/BatchRequest HTTP/1.0" 200 298 "http://zmail.peak.org/zimbra/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 1
69.59.192.10 - - [24/Oct/2014:01:17:34 +0000] "POST /service/soap/BatchRequest HTTP/1.0" 200 261 "http://zmail.peak.org/zimbra/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 3
69.59.192.10 - - [24/Oct/2014:01:17:34 +0000] "GET /zimbra/skins/_base/logos/AppBanner_white.png?v=140828194005 HTTP/1.0" 200 - "http://zmail.peak.org/zimbra/css/images,common,dwt,msgview,login,zm,spellcheck,skin.css;jsessionid=dt0nxieqraij1488ck2quhz8p?v=140828194005&debug=false&skin=beach&locale=en_US" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 7
69.59.192.10 - - [24/Oct/2014:01:17:34 +0000] "GET /zimbra/js/ContactsCore_all.js.zgz?v=140828194005 HTTP/1.0" 200 26643 "http://zmail.peak.org/zimbra/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 7
207.55.16.111 - - [24/Oct/2014:01:17:34 +0000] "GET /service/extension/nginx-lookup HTTP/1.0" 200 - "-" "-" 1
69.59.192.10 - - [24/Oct/2014:01:17:34 +0000] "GET /home/alan@cmug.com/Contacts?fmt=cf&t=2&all=all HTTP/1.0" 200 - "http://zmail.peak.org/zimbra/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.104 Safari/537.36" 2


So I guess, if no one has an obvious answer, at least a pointer to where any more detailed errors about the soap request would be helpful.  Thanks!




Daniel2
Posts: 2
Joined: Thu Jul 16, 2015 6:16 am

login hangs when accessed through an nginx proxy

Postby Daniel2 » Thu Jul 16, 2015 6:17 am

Hello!



Is there in the meantime, a solution to the problem?
abatie
Advanced member
Advanced member
Posts: 59
Joined: Thu Aug 07, 2014 12:02 pm

login hangs when accessed through an nginx proxy

Postby abatie » Thu Jul 16, 2015 6:36 pm

Our workaround was to have the load balancer (centos/piranha) in front of our proxy redirect http/https directly to a zimbra mta and only route to nginx for pop/imap/smtp
abatie
Advanced member
Advanced member
Posts: 59
Joined: Thu Aug 07, 2014 12:02 pm

Re: login hangs when accessed through an nginx proxy

Postby abatie » Thu Sep 13, 2018 1:05 am

I found a way to make the nginx proxy work:

proxy_set_header Referer "https://<a hostname zimbra knows>";

That is, the nginx proxy is accessed via a name not configured in zimbra, and that seems to be what's causing the BatchRequest failure. Changing the referer header so something zimbra does know solved the problem for me in this case.

Return to “General Questions”

Who is online

Users browsing this forum: No registered users and 2 guests