RSA SecurID Access is unable to proxy to HTTPS hosts for HTTP Federation Proxy or Trusted Header Applications
3 years ago
Originally Published: 2018-01-29
Article Number
000041346
Applies To
RSA Product Set: SecurID Access
RSA Product/Service Type: Identity Router
RSA Version/Condition: 1.5.4
Issue
When a new HTTP Federation Proxy (HFED) or Trusted Headers application is created where the virtual host is setup to use HTTPS or “BOTH”, the RSA Identity Router (IDR) fails to connect to the application, because it is trying to send HTTP traffic to HTTPS port 443 of the webserver of the application.
 
Cause
When a new HFED or Trusted Headers application is created where the virtual host is setup to use HTTPS or “BOTH”, the /etc/apache2/httpd.conf file within the IDR is created incorrectly. A number of parameters within the file reference the HTTP protocol on port 443. The correct configuration should use HTTPS on port 443 when proxying for HTTPS or BOTH.
 
Resolution
A fix is planned for a future RSA SecurID Access Cloud/IDR release.
Workaround
Login to the RSA SecurID Access Cloud Authentication Console, navigate to the Application tab and edit the affected HFED or Trusted Headers application.

On the "4. Proxy Settings" screen of your application:
  1. Click the Pencil icon to view the configuration of the existing Web Server you have configured.
  2. Make a note of the values you have configured for Proxy Hostname, Real Hostname, and any Rewrite Rules.
  3. Click Cancel to close the window.
  4. Delete the existing Web Server you added
  5. Click Add to add a new Web Server
  6. Select 'HTTP' and uncheck the checkbox that shows up labeled 'Enable HTTPS communication between user and identity router'
  7. Select 'HTTPS'.
  8. Fill in all values you had before for Proxy Hostname, Real Hostname, and any Rewrite Rules.
  9. Click Save
  10. Navigate to the "6. Portal Display" screen.
  11. Click Save and Finish
  12. Publish
Notes
 You can download an IDR's /etc/apache2/httpd.conf file for viewing, in the RSA Identity Router bundle logs.
Don't see what you're looking for?