Mellon login redirect points to http instead of https

[alexdyas]

Hello,

Env:
Mod Mellon v0.19.1
Apache 2.4.65-2
Virtual Host listening on port 80, behind a reverse proxy handling TLS

I'm seeing the following when I access <Location /secret> within which Mellon is configured:

[APLOG_DEBUG auth_mellon_handler.c:3851] Redirecting to login URL: http://webserver001.example.com/secret/endpoint/login?ReturnTo=http%3A%2F%2Fwebserver001.example.com%2Fsecret%2F&IdP=urn%3Aexample%3Amyteam%3Awebserver001

This redirection doesn't work because it points to http instead of https. Why is this happening, and how can I make the redirect use https instead?

Thanks.

[alexdyas]

Ok, I dug through the Mellon source and see that the redirection URL comes from Apache (ap_construct_url). As my virtual host in not configured for TLS, the returned URL will always start with http://, Apache has no idea of the upstream TLS proxy.
So rather than kludge a http to https rewrite in Apache I made the modification in the proxy where it belongs, in my case Kubernetes Nginx Ingress:

metadata:
  annotations:
    nginx.ingress.kubernetes.io/proxy-redirect-from: "http://"
    nginx.ingress.kubernetes.io/proxy-redirect-to: "https://"

[alexdyas]

So, Apache/Mellon still sends http prepended URLs back to the client, often embedded in long URLs. The above solution doesn't take these into account.

I have eventually made the following modification to my Apache vhost to force Apache into replying with https prepended URLs:

Was:

<VirtualHost *:80>
    ServerName http://webserver001.example.com
    <...>

Changed to:

<VirtualHost *:80>
    ServerName https://webserver001.example.com
    <...>

This isn't strictly clean, the vhost is not an https server, but it fixes a lot of issues.

I hope this is of use to someone else :-)