Channel Security behind SSL Accelerator

[dhainlin]

I have the following scenario.
Load Balancer(LB) (with SSL HW Accelerator) -> Web Server (WS) -> App Server (AS) running acegi.

Pretty standard. A browser can have http or https connections to the LB but downstream, the WS and AS only receive http connections. We originally forced all traffic to be https (via redirectors) but now are looking at selective channel security. I've used acegi's channel security on other projects but the AS handled the SSL so no problem.

The only way I can figure out how to make this work is to create a custom channel processor that looks at the server port to make the decision. The default SecureChannelProcessor didn't work because the LB isn't reporting the connection isSecure to the AS. My approach does work but it has a slightly bad smell. Surely others have worked with channel filtering where the SSL processing is handled upstream of the AS/acegi layer. How have others done this?

BTW, I looked into what options either the LB or even our WS could set to indicate if the user was in a secure connection or not. I didn't see any but may have missed them....

My implementation goes something like this:

   <bean id="secureChannelProcessor" class="my.package.PortBasedChannelProcessor">
     <property name="entryPoint" ref="secureChannelEntryPoint"/>
     <property name="portMapper" ref="portMapper" />
     <property name="secureKeyword" value="REQUIRES_SECURE_CHANNEL"/>
   </bean>

The implementation of PortBasedChannelProcessor simply uses the portMapper to test if portMapper.lookupHttpPort(request.getServerPort() ) returns a value (indicating we are running on a port designated as https according to our port mapper. The implementation has a flag which can cause it to lookup https ports so the processor can be used as an insecure decider too.

Pretty simplistic but it seems to work.

Thanks in advance.
David

[Ben Alex]

David, if you are willing to pop a patch into JIRA for SecureChannelProcessor and InsecureChannelProcessor to use PortMapper, I'd be pleased to apply it.

[dhainlin]

Ben,
I created SEC-261. I didn't quite know how to pop a patch into JIRA (I'm a JIRA newbie) so I may not have made it very easy for you. Let me know if I need to do something additional/different.
Thanks,
David

[csubbu]

Hi David,

WIth your approach, do we need to specify the load balancer/WS port in the port mapper or do we need to specify the AS port in the port mapper. For example we are running this app on tomcat 8080/8443 and my port mapper has this port configured in the security.xml. will this work or should I specify something else?

Thanks in advance,
chandru