SSO Login beind reverse proxy

[willfurnell]

Hello,
I'm struggling to get login behind a reverse proxy to work properly.
I am running InvenTree with Docker, v0.17.9, running on the hostname inventree2.example.com.
I also run haproxy in front of InvenTree, with inventree.example.com pointing to that.
I have INVENTREE_SITE_URL=https://inventree.example.com
I've got SSO configured with Microsoft for Azure/Entra ID, and the redirect URL configured there as https://inventree.example.com/accounts/microsoft/login/callback/
However, for some reason InvenTree seems to be sending Microsoft the inventree2.example.com URL to redirect to - which is not what I want and breaks SSO. Is there a particular setting I should be using for this, or some way to make sure the hostname sent to the SSO provider is the right one?
Thanks!

[SchrodingersGat]

Have you entered the inventree2 URL anywhere? I don't see how that would be generated - my suspicion would be that this URL has been accidentally entered somewhere

[willfurnell]

Unfortunately I've grepped everywhere and can't see it being set in my .env or my config.yaml. Is there a way I can log the POST requests to the SSO provider and what we get back from the SSO provider (and then I can stick the JWT in jwt.ms) to see where that may be coming from please?

[willfurnell]

When I click on the 'Microsoft' button to sign in, this is the URL that it sends me to, so it definitely seems like InvenTree is giving it the wrong redirect URI (rather than MS doing it)
https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=xxx&redirect_uri=https%3A%2F%2Finventree2.example.com%2Faccounts%2Fmicrosoft%2Flogin%2Fcallback%2F&scope=User.Read&response_type=code&state=xxx

[SchrodingersGat]

You should be able to trace at least some of the messages straight from your browser developer tools

[willfurnell]

Unfortunately not regarding this - as far as I can see with the POST request when clicking the 'Microsoft' button I'm immediately redirected to the URL above - nothing client side seems to be sending that particular redirect_uri. Where does the SSO integration get that redirect_uri from? Is there a way to force it perhaps? (I assume this is because I'm running a reverse proxy)

[SchrodingersGat]

You likely need to play around with your site access settings:

https://docs.inventree.org/en/stable/start/config/#server-access

In particular, the use_x_forwarded_host setting should be enabled if you are behind a proxy

You may also need to adjust haproxy to send these headers through

[willfurnell]

I'm really sorry - this was my fault! To try and fix another issue I was having (SNI and IPv6 issues on our network) I was forcing the Host header to be the inventree2.example.com in my haproxy config like so:

backend inventree_prod
    mode http
    option httpchk
    option forwardfor
    default-server check ssl verify none check-sni inventree2.example.com
    http-request set-header Host inventree2.example.com
    server inventree-docker inventree2.example.com:443

I changed this to:

backend inventree_prod
    mode http
    option httpchk
    option forwardfor
    default-server check ssl verify none check-sni inventree2.example.com
    http-request set-header Host inventree.example.com
    server inventree-docker inventree2.example.com:443

Which has fixed my issue. Apologies, completely on my end!