[SOLVED] How do I set up reverse proxy in Apache on a Slackware 14.2 Server?

Originally Posted by cesarsj I think we have a breakthrough, finally! The error has changed, it is now recorded in log_log: [Wed Feb 24 17:15:04.781782 2021] [ssl:info] [pid 12386:tid 139710336833280] [remote 192.168.6.253:3000] AH01997: SSL handshake failed: sending 502 [Wed Feb 24 17:15:04.781790 2021] [proxy:error] [pid 12386:tid 139710336833280] (20014)Internal error (specific information not available): [client 192.168.13.7:39496] AH01084: pass request body failed to 192.168.6.253:3000 (myu.com) [Wed Feb 24 17:15:04.781809 2021] [proxy:error] [pid 12386:tid 139710336833280] [client 192.168.13.7:39496] AH00898: Error during SSL Handshake with remote server returned by /grafana On the page myu.com/grafana appears: Proxy Error The proxy server could not handle the request Reason: Error during SSL Handshake with remote server

Most likely you use http instead of https in grafana config.
Look again at my post 19 with a working config for both apache and grafana and adjust that to your needs.

Originally Posted by bathory Most likely you use http instead of https in grafana config. Look again at my post 19 with a working config for both apache and grafana and adjust that to your needs.

I left it as below and it seems to have worked:

SSLProxyEngine On
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off

ProxyPreserveHost On
ProxyPass "/grafana" "https://127.0.0.1:3000"
ProxyPassReverse "/grafana" "https://127.0.0.1:3000"

However, when I place the LDAP authentication policies below, a json result appears on the page: message "Invalid username or password". I think it only remains to resolve this to be all OK.

<Location /grafana>
     ProxyPass "http://192.168.6.3:3000/"
     ProxyPassReverse "http://192.168.6.3:3000/"

     SSLRequireSSL
     AuthType basic
     AuthBasicProvider ldap
     AuthName "Restricted access"
     AuthLDAPBindDN cn=apacheldap,ou=DSA,dc=myu,dc=com
     AuthLDAPBindPassword xxxxxxxx
     AuthLDAPURL ldap://ldap2.myu.com:389/ou=people,dc=myu,dc=com?uid?one TLS
     AuthLDAPGroupAttribute memberUid
     AuthLDAPGroupAttributeIsDN off
     Require ldap-group cn=crsintranetrestrita,ou=groups,dc=myu,dc=com
</Location>

Originally Posted by cesarsj I left it as below and it seems to have worked: SSLProxyEngine On SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off ProxyPreserveHost On ProxyPass "/grafana" "https://127.0.0.1:3000" ProxyPassReverse "/grafana" "https://127.0.0.1:3000" However, when I place the LDAP authentication policies below, a json result appears on the page: message "Invalid username or password". I think it only remains to resolve this to be all OK. <Location /grafana> ProxyPass "http://192.168.6.3:3000/" ProxyPassReverse "http://192.168.6.3:3000/" SSLRequireSSL AuthType basic AuthBasicProvider ldap AuthName "Restricted access" AuthLDAPBindDN cn=apacheldap,ou=DSA,dc=myu,dc=com AuthLDAPBindPassword xxxxxxxx AuthLDAPURL ldap://ldap2.myu.com:389/ou=people,dc=myu,dc=com?uid?one TLS AuthLDAPGroupAttribute memberUid AuthLDAPGroupAttributeIsDN off Require ldap-group cn=crsintranetrestrita,ou=groups,dc=myu,dc=com </Location>

I saw that in the log of grafana, grafana.log, it appears:

t = 2021-02-24T19: 38: 09-0300 lvl = dbug msg = "Failed to authorize the user" logger = context username = cesarsj err = "User not found"

Funny that when the reverse proxy didn't work and I accessed the grafana directly it didn't happen.

However, when I place the LDAP authentication policies below, a json result appears on the page: message "Invalid username or password". I think it only remains to resolve this to be all OK. Code: <Location /grafana> ProxyPass "http://192.168.6.3:3000/" ProxyPassReverse "http://192.168.6.3:3000/" SSLRequireSSL AuthType basic AuthBasicProvider ldap AuthName "Restricted access" AuthLDAPBindDN cn=apacheldap,ou=DSA,dc=myu,dc=com AuthLDAPBindPassword xxxxxxxx AuthLDAPURL ldap://ldap2.myu.com:389/ou=people,dc=myu,dc=com?uid?one TLS AuthLDAPGroupAttribute memberUid AuthLDAPGroupAttributeIsDN off Require ldap-group cn=crsintranetrestrita,ou=groups,dc=myu,dc=com </Location>

First you should remove the trailing slashes from the backend URL, i.e. it should read:

<Location /grafana>
     ProxyPass "http://192.168.6.3:3000"
     ProxyPassReverse "http://192.168.6.3:3000"
<-snip->

Second putting the ldap authentication stuff there, it's used by apache to allow access to that resource only for users authenticated by your ldap server.
It has nothing to do with the grafana backend.

I saw that in the log of grafana, grafana.log, it appears: t = 2021-02-24T19: 38: 09-0300 lvl = dbug msg = "Failed to authorize the user" logger = context username = cesarsj err = "User not found" Funny that when the reverse proxy didn't work and I accessed the grafana directly it didn't happen.

As I told you above LDAP AUTH has nothing to do with grafana because stores its users in a different database.
If you want to allow users from your ldap server to access/use grafana, you need to configure grafana accordingly.
Searching for "grafana+ldap" yielded many results like this
Use your favorite search engine to find more, because that's a different issue from your OP and I'm afraid I cannot help you further.

Regards

Originally Posted by bathory First you should remove the trailing slashes from the backend URL, i.e. it should read: <Location /grafana> ProxyPass "http://192.168.6.3:3000" ProxyPassReverse "http://192.168.6.3:3000" <-snip-> Second putting the ldap authentication stuff there, it's used by apache to allow access to that resource only for users authenticated by your ldap server. It has nothing to do with the grafana backend. As I told you above LDAP AUTH has nothing to do with grafana because stores its users in a different database. If you want to allow users from your ldap server to access/use grafana, you need to configure grafana accordingly. Searching for "grafana+ldap" yielded many results like this Use your favorite search engine to find more, because that's a different issue from your OP and I'm afraid I cannot help you further. Regards

Yes, you are right, the problem in question has been solved. I really appreciate the helpfulness of helping me all this time.